Stripe "authentication_required"? The card's fine — don't retry, do 3DS

Your Stripe charge came back authentication_required, or your PaymentIntent is stuck at requires_action. The instinct is to treat it as a dead card and retry or give up. Both are wrong: the card is valid — the bank just wants 3D Secure.

What it actually means

Since 2019, card issuers can return authentication_required to demand 3D Secure / Strong Customer Authentication (SCA), often to comply with European regulation. It's a hard decline for this attempt but the card is good. A related signal is a PaymentIntent at status requires_action, or the API error requires_action_not_handled — your integration created a payment that needs a 3DS step it didn't handle.

The correct flow

1. On-session (customer present): remove error_on_requires_action so the PaymentIntent goes to requires_action instead of declining; drive the 3DS modal client-side (use_stripe_sdk / confirmCardPayment); then confirm the PaymentIntent again server-side to finalize.
2. Off-session / recurring: you can't authenticate live — set up a SetupIntent with off_session earlier so the card is pre-authenticated, and pass the saved payment method with MIT (merchant-initiated) flags; or notify the customer to complete authentication.
3. Already-3DS'd but still declined: that's an issuer issue — the customer contacts their bank or uses a different card.

Snapback's procurement family covers this alongside the card-decline and Radar-block patterns — diagnose_infra_error returns the do-3DS-don't-retry fix so an agent doesn't hammer a valid card.