Authorize, raise the hold if the order grows, then capture
Keep one authorization for the whole order and raise it, rather than adding a second payment beside the first.
Your answers so far
Choose one
What to build
Authorize the amount you know about when the customer orders. When the order grows, send an IncrementalAuthorization on the operations endpoint to raise the existing hold. Capture the final amount when you deliver.
What this means for PCI
This is guidance rather than a compliance determination. Which questionnaire you are eligible for depends on your full environment, so confirm it with your QSA or your acquirer before you rely on it.
Worth knowing
- An incremental authorization sends a new authorization message to the card network, so the issuer can refuse it. Decide in advance what you do with an order that grew past what the customer's bank would approve.
- Not every processor supports incremental authorization. Check that the merchant's processor offers it before you design around it.
- An authorization is captured once. Capturing less than you authorized releases the rest of the hold, and a second capture for the remainder is refused.