Credit Card two-step payments allow a merchant to first authorize a transaction and reserve the amount on the customer’s card, and later perform a separate capture operation to settle the funds.

In a two-step scenario, authorization and capture are independent operations. The customer approves the transaction during checkout, but the merchant controls when the funds are captured within the authorization validity period.

This model is commonly used in industries where fulfillment or service confirmation occurs after checkout.

How It Works

In a typical Credit Card two-step payment flow:

1. The merchant initiates an authorization request through the SIBS Payment Gateway.
2. The customer provides card details through a secure payment form or hosted page.
3. The transaction is sent to the acquiring network for authorization.
4. Strong Customer Authentication (e.g., 3D Secure) is applied when required.
5. Upon successful authorization, the amount is reserved on the card.
6. The merchant receives the authorization result and stores the authorization transaction identifiers required for capture.
7. At a later moment, the merchant initiates a capture request referencing the authorized transaction.
8. The funds are captured and the transaction is finalized.

The customer interaction occurs only during the authorization phase. The capture phase is merchant-initiated and does not require further customer interaction.

Workflow Characteristics

The Credit Card two-step flow has the following characteristics:

• Real-time authorization response
• Funds reservation (not immediate settlement)
• Separate capture operation
• Authorization validity period
• Partial capture support (where applicable)
• Automatic release of funds if authorization expires
• Authorization and capture lifecycle monitoring through Merchant Notifications and Status Inquiry

If capture is not executed within the authorization validity window, the reserved amount is automatically released by the issuing bank.

Authorized transactions may also be released through expiration or cancellation according to issuer, scheme, or merchant operational processes.

The SPG transactionID should be treated as the authoritative identifier for transaction monitoring, webhook correlation, authorization tracking, capture operations, reconciliation, refund operations, and Status Inquiry requests throughout the transaction lifecycle.

Transaction Lifecycle

The following diagram illustrates the operational lifecycle of a Credit Card two-step payment within the SIBS Payment Gateway, including authorization, customer authentication, capture execution, expiration handling, status validation, and merchant reconciliation.

The lifecycle of a Credit Card two-step payment typically includes:

• Payment creation (authorization request)
• Authentication (if required)
• Authorized (funds reserved)
• Captured (successful settlement)
• Expired (if not captured in time)
• Declined or failed (if authorization is not approved)

The transaction is considered fully settled only after capture is successfully completed.

Use Cases

Credit Card two-step payments are commonly used in:

• Hotel and hospitality bookings
• Car rentals
• Travel and ticket reservations
• E-commerce with delayed shipment
• Orders requiring manual validation
• High-value transactions requiring additional controls
• Merchants requiring fraud review or operational approval before settlement

This payment model is particularly suited for environments where:

• The final charge amount may change before fulfillment
• Delivery or service confirmation is required
• Immediate settlement is not appropriate
• Refund avoidance is preferred through delayed capture

For transaction lifecycle monitoring and final transaction state validation, refer to E.2 – Status Inquiry / Get Status.

For webhook delivery and asynchronous transaction notifications, refer to E.1 – Webhooks (Notifications).

Authorization request examples, capture request examples, Postman collections, and end-to-end Credit Card two-step transaction flows are documented in F. Technical Examples and Best Practices.

Particularities in the SIBS Context

When working with Credit Card two-step payments in SIBS SPG, several platform-specific aspects should be considered:

• Authorization and capture are separate operations and must be managed independently.
• Strong Customer Authentication (3D Secure) may be required during the authorization phase depending on regulatory and issuer requirements.
• Authorized transactions remain valid only during the applicable authorization validity period.
• If capture is not executed within the allowed timeframe, the authorization expires and the reserved funds are released automatically.
• Webhook notifications and Status Inquiry validation should be implemented for reliable authorization and capture lifecycle monitoring.
• Capture operations should be implemented idempotently to prevent duplicate settlement.
• Proper authorization tracking, capture execution, and transaction lifecycle monitoring are critical to guarantee operational consistency and accurate reconciliation.
• Partial capture availability depends on merchant configuration, acquiring setup, and applicable scheme rules.

Integration Context

Within the SIBS Payment Gateway, Credit Card two-step payments require:

• An initial authorization request
• Storage of the authorization transaction identifiers required for capture
• A separate server-to-server capture request

The capture operation must reference the original authorized transaction.

Merchants must implement logic to:

• Track authorization status
• Execute capture within the allowed validity period
• Handle expired authorizations
• Manage partial or full capture rules (if applicable)
• Prevent duplicate capture attempts

The following sections describe the technical integration flow, authentication handling, capture execution, and post-authorization management for Credit Card two-step payments.