Pre-Authorization

Pre-authorization (pre-auth) allows merchants to temporarily block funds on a customer’s card and capture the payment later, typically after order fulfillment. This helps secure funds without charging the customer immediately.

Cashfree Payment Gateway (PG) supports pre-auth for Visa and Mastercard credit and debit cards.

How pre-authorization works?

With pre-auth, you can :

• Authorize an amount on a customer’s card without immediate capture.
• Capture the authorized amount later (fully or partially) when ready.
• Void the authorization to release funds if the transaction is not completed.

Unlike standard transactions, where funds are instantly captured, pre-auth provides flexibility in payment processing.

Pre-authorization flow

1. The customer initiates the payment.
2. The amount is blocked on the customer’s card after successful payment completion.
3. The merchant can:

   • Either Capture the full or partial amount.

     OR

   • Void the authorization to release the blocked funds to the customer.

Note: If not captured within seven days, the funds are automatically released.

Pre-authorization feature request

• To enable pre-auth for your account, submit a request via the Support Form.

Managing pre-authorization transactions

You can capture or void pre-auth transactions from the Cashfree Merchant Dashboard or integrate the capture and void APIs to automate the process.

Note

• You must capture or void a pre-auth transaction within seven days of authorization.
• A transaction can only be captured or voided once.
• Once captured, a transaction cannot be voided.
• Once voided, a transaction cannot be captured.
• Transactions not captured within 7 days are automatically released back to the customer.
• Voided transactions return funds to the customer immediately.
• After pre-auth is enabled for your account, ensure all Pre Auth transactions are either captured or voided.

Supported payment instruments for pre-authorization

Cashfree Payment Gateway supports pre-auth workflow on cards and UPI (Unified Payments Interface).

Cards

If you are using cards, you do not need to provide any additional parameters while initiating the payment.

Below is a sample /orders/pay request and response:

/orders/pay request

  curl --request POST \
    --url https://sandbox.cashfree.com/pg/orders/sessions \
    --header 'Content-Type: application/json' \
    --header 'x-api-version: <x-api-version>' \
    --data '{
    "payment_method": {
      "card": {
        "card_cvv": "900",
        "card_display": "3243",
        "card_expiry_mm": "03",
        "card_expiry_yy": "26",
        "card_number": "4111111111111111",
        "channel": "link",
        "cryptogram": "AQBBBBBBZatIlaIAmWKSghwBBBB=",
        "token_requestor_id": "22457512314",
        "token_type": "ISSUER_GC_TOKEN"
      }
    },
    "payment_session_id": "session__CvcEmNKDkmERQrxnx39ibhJ3Ii034pjc8ZVxf3qcgEXCWlgDDlHRgz2XYZCqpajDQSXMMtCusPgOIxYP2LZx0-05p39gC2Vgmq1RAj--gcn"
  }'

UPI

For UPI pre-auth, you need to pass additional parameters in the /orders/pay API request. Once you have created the order, invoke the Order Pay API call with the authorize_only, authorization parameters.

The authorization object contains the following attributes:

• approve_by - The time by when customer needs to approve this one time mandate request.
• start_time - The time when the mandate should start.
• end_time - The time until when the mandate hold will be on customer’s bank account. You can call capture and void until this time.

UPI Collect

Below is a sample UPI Collect request and response:

UPI pre-auth payment request

curl --request POST \
  --url https://api.cashfree.com/pg/orders/sessions \
  --header 'Content-Type: application/json' \
  --data '{
	"payment_session_id": "HTIdYxfOYgqKyYM3rLCZ",
	"payment_method" : {
		"upi" : { 
			"channel": "collect",
			"upi_id": "rohit@okicici",
			"authorize_only": true,
			"authorization" : {
          "approve_by": "2022-02-08T19:20:12+05:30",
          "start_time": "2022-02-09T12:34:34Z",
          "end_time": "2022-02-10T12:34:34Z"
       }			
		}
	}
}'

UPI Intent

Below is a sample UPI Intent request and response:

UPI pre-auth payment request

curl --request POST \
  --url https://api.cashfree.com/pg/orders/sessions \
  --header 'Content-Type: application/json' \
  --data '{
	"payment_session_id": "HTIdYxfOYgqKyYM3rLCZ",
	"payment_method" : {
		"upi" : { 
			"channel": "link",
			"authorize_only": true,
			"authorization" : {
          "approve_by": "2022-02-08T19:20:12+05:30",
          "start_time": "2022-02-09T12:34:34Z",
          "end_time": "2022-02-10T12:34:34Z"
       }			
		}
	}
}'

Capture

The capture workflow helps you to capture the payment and move the authorised amount partially or completely from customers bank account to your bank account.

Capture request

curl --request POST \
  --url https://api.cashfree.com/pg/orders/:order_id/authorization \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: <<api_version>>' \
  --header 'x-client-id: <<app_id>>' \
  --header 'x-client-secret: <<secret_key>>' \
  --data '{
  "action": "CAPTURE",
  "amount": "2.00"
}'

Void

The void workflow helps you to release the entire authorized amount back to the customer.

Void request

curl --request POST \
  --url https://api.cashfree.com/pg/orders/:order_id/authorization \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: <<api_version>>' \
  --header 'x-client-id: <<app_id>>' \
  --header 'x-client-secret: <<secret_key>>' \
  --data '{
  "action": "VOID"
}'

FAQs

What is a capture call in Pre-Authorization?

Capture call is performed after authorization. It is a merchant-initiated request (via API) to collect the previously authorized funds. This step debits the amount from the customer.

What is the validity of capture?

If not captured within 7 days, the authorization expires, and the funds are released back to the customer.

Can a merchant capture a partial amount?

Yes, merchants can capture a partial amount of the authorized funds.

Is MDR charged on the authorized or captured amount?

MDR is always applied only on the captured amount.

Which cards support pre-authorization?

All Visa and Mastercard credit and debit cards support pre-authorization.

What is void in Pre-Authorization?

A void call cancels the authorization before capture, releasing the hold on funds.

Can a merchant void a partial amount?

No, voiding must be for the entire authorized amount.

What are some common use cases for Pre-Authorization?

Here are some common use cases:

• Ticket Bookings – Airlines, concerts, and events often place a hold on a credit card to ensure funds are available before finalizing the booking. This is useful if confirmation is pending or for refundable ticket options.
• Car Rentals – Rental companies use pre-authorization to secure a deposit in case of damages, late returns, or additional charges. The hold is released if no extra fees are incurred.
• Hotel Reservations – Hotels pre-authorize a guest’s credit card at check-in to cover potential incidentals, damages, or unpaid charges, ensuring payment security before checkout.

Is pre-authorization feasible via payment links and payment forms?

Yes, pre-authorization (Pre Auth) is feasible on both payment links and payment forms.

Payment Links

1. The merchant generates a payment link on a pre-authorization-enabled account.
2. The customer clicks the link and enters payment details.
3. The payment is authorized (funds are held but not captured immediately).
4. The merchant can capture the payment later when needed.
5. If the order is canceled, the hold can be released without charging the card.

Payment Forms

• The customer enters payment details in the form.
• The system processes an authorization-only request.
• The merchant can capture the funds later or release the authorization if the transaction is voided.

How does settlement occur in a pre-authorization transaction?

Settlement occurs when the merchant finalizes a pre-authorized transaction by capturing the funds.

When does the merchant receive the funds in a pre-authorization transaction?

Merchants typically receive funds from pre-authorized transactions as per their normal settlement cycle, i.e., T+x days after a successful capture.

What happens if a customer disputes a settled transaction?

A dispute may result in a chargeback, requiring the merchant to provide proof of authorization and service fulfillment.

Is the pre-authorization feature supported on American Express and Diners cards?

Currently, the pre-authorization feature is not supported for American Express and Diners cards due to limitations imposed by the respective card networks. We are actively monitoring any changes in network policies and will update our services accordingly if support becomes available in the future.