Stripe Subscriptions with 3d secure card and next_action null

Question

We are working to prepare our Stripe Subscription workflow to comply with the new SCA requirements for online payments coming into effect the 14th September 2019. We are facing some issues when trying to adapt out Javascript and PHP code in order to accept 3d secure credit cards when creating subscriptions.

We've already tried the what was pointed here but with no luck. We are sending the enable_incomplete_payments = true when creating the Subscription from the server side, but the response return next_action = null although the status of the subscription is pending .

This is what we are doing step by step:

(client) We start elements

let stripe = window.Stripe(key);
let elements = stripe.elements();
[...]
let card = elements.create('card', {style: style});
[...]

(client) we use the test card 4000000000003220 (3d secured)

(client) createToken() -> send token to server

createToken(formId).then((result)=>{
    if (result.error) {
        //handle errors
    } else{
        //send result.token to backend
    }
})

(server) get token from client and create customer:

Customer::create([
    "description" => $user->name,
    "email" => $user->email,
    "source" => $token, // obtained with Stripe.js
]);

(server) create subscription

    $response = Subscription::create([
            "customer" => $customerId,
            "items" => [
                ["plan" => $planId],
            ],
            "prorate" => false,
            "expand" => ["latest_invoice.payment_intent"],
            'enable_incomplete_payments' => true
        ]);

    if ($response->status == 'incomplete') {
        $payment_intent = $response->latest_invoice->payment_intent->client_secret;
        //send payment intent client secret to frontend to perform authorization
    }

Here we should have the status=requires_action as a response but we are receiving the status=null instead. And in the next step:

    stripe.handleCardPayment(paymentIntentSecret, element)

And here fails (no other action or popup), with error:

"error": {
    "charge": "ch_1EhvwjBqa3pLeb3ypVgXafhI",
    "code": "authentication_required",
    "decline_code": "authentication_required",
    "message": "Your card was declined. This transaction requires two-factor authentication.",
[...]

Thank you, Marco

Answer 1

This is because you're using an older API version from before the incomplete status existed. To use this SCA-ready flow, you can either opt in by passing "enable_incomplete_payments" => true when creating the subscription, or use https://stripe.com/docs/api/versioning to make the API requests using a more recent API version. It's described in detail here:

https://stripe.com/docs/billing/lifecycle#incomplete-opt-in