Authorization

A payment authorization is the step where a card issuer approves or declines a transaction and, on approval, places a hold on the requested amount in the cardholder's account. It confirms that the card is valid and that enough credit or funds are available, but it does not move any money on its own. The transfer to the merchant happens later, when the transaction is captured and then settled. An authorization can expire or be voided before capture, which releases the hold.

Authorization is the first live exchange between a merchant and a card issuer during a purchase. The merchant's payment gateway sends the card details and amount to the issuer through the card network, and the issuer responds with an approval or a decline. On approval, the issuer reserves the amount so the cardholder cannot spend it elsewhere, which is why an authorization sometimes shows up as a pending charge even though nothing has actually been paid yet. For subscription businesses, authorizations happen on the first sign-up and again on each renewal, so how reliably they succeed directly shapes how much recurring revenue collects without friction.

Why authorization matters for subscription businesses

Every recurring charge starts with an authorization, so authorization outcomes decide whether a renewal succeeds or turns into a failed payment that has to be recovered. A declined authorization means no capture and no revenue for that cycle until the issue is resolved. Watching approval rates, and understanding why authorizations decline, is one of the most direct levers a subscription operator has on collected revenue. It also affects customer experience, since a wrongly declined authorization can look to the customer like their account was cut off for no reason.

How to use authorization

Treat authorization as a control point, not just a technical formality:

• Use an authorization to confirm a card is good before you provision access, especially at sign-up or when a customer updates their payment method.

• Decide deliberately whether to capture immediately or authorize now and capture later, based on when you actually deliver value.

• Monitor approval rates by card type, region, and issuer so you can spot a drop that points to a configuration or routing problem.

• When an authorization is declined, route the response into your retry and dunning logic rather than treating every decline the same way, since some declines are worth retrying and some are not.

Authorization vs capture

These two steps are often treated as one, but they are distinct.

• Authorization asks the issuer to approve the transaction and hold the funds. It confirms the card and reserves the amount, but no money moves.

• Capture is the request that tells the issuer to actually move the held funds toward the merchant. Capture is what starts the transfer that later completes at settlement.

A merchant can authorize and capture together in one step, or authorize first and capture later once value is delivered. An authorization that is never captured will expire, and the hold is released back to the cardholder. See Settlement for what happens after capture, and Void for canceling an authorization before capture.

Benefits and examples

Authorizing before delivering value protects the business from handing over a subscription that will never collect. A streaming service, for example, can authorize a card at sign-up to confirm it is valid, then capture on the first billing date. If the card fails authorization at renewal, the service learns immediately and can prompt the customer to update their details before losing access, rather than discovering the problem after the fact. Clean authorization handling also reduces support load, because fewer customers are surprised by a lapse they did not cause.

A subscription management platform adds the most value here by turning raw authorization responses into action. Instead of a merchant reading decline codes by hand, an integrated billing system can attempt an authorization on each renewal, interpret the response, and feed failures directly into automated retry and customer communication so recoverable revenue is not lost to a single declined attempt. At the operator level, the benefit is that authorizations, retries, and dunning work as one connected flow rather than separate manual steps. Recurly's Intelligent Retries adapts retry timing to the specific decline reason instead of applying one fixed schedule, and Account Updater proactively refreshes card details ahead of a renewal so an authorization has a better chance of succeeding in the first place.

Frequently asked questions

What is a payment authorization? It is the step where the card issuer approves or declines a transaction and, if approved, holds the amount on the cardholder's account. It verifies the card and reserves funds, but it does not transfer money by itself.

What is the difference between authorization and capture? Authorization approves the transaction and holds the funds. Capture is the separate request that actually moves those held funds toward the merchant. You can do both at once or authorize first and capture later.

Does an authorization charge the customer? Not on its own. It places a hold that can appear as a pending charge, but money only moves once the transaction is captured and settled. If the authorization is voided or expires, the hold is released.

How long does an authorization hold last? Holds are released automatically if the transaction is not captured within a window set by the card network and issuer. This is typically 7 to 10 days, though the exact window varies by card brand and payment gateway.

Why would an authorization be declined? Common reasons include insufficient funds, an expired or incorrect card, a suspected fraud flag, or issuer rules. Some declines are temporary and worth retrying, while others signal a problem that a retry will not fix. See Hard decline and Payment decline.