Learn Anatomy of a Checkout

Lesson 3 of 13

Authorization.

The round trip from merchant to issuer, what an approval really means, and how long a hold lasts.

By Nagesh Koritala 4 min read Last verified: November 2026

  1. Lesson 1: Improve the checkout
  2. Lesson 2: The checkout flow
  3. Lesson 3: Authorization (this lesson)
  4. Lesson 4: Payment states
  5. Lesson 5: Capture
  6. Lesson 6: Clearing and settlement
  7. Lesson 7: Cash capture
  8. Lesson 8: Returns and refunds
  9. Lesson 9: Disputes
  10. Lesson 10: Tokens and stored credentials
  11. Lesson 11: Transaction types
  12. Lesson 12: Complete reference
  13. Lesson 13: Payments compliance
All 16 pages in this guide
  1. Improve the checkout
  2. The checkout flow
  3. Authorization
  4. Payment states
  5. Capture
  6. Clearing and settlement
  7. Cash capture
  8. Returns and refunds
  9. Disputes
  10. Tokens and stored credentials
  11. Transaction types
  12. Complete reference
  13. Payments compliance
  14. Follow one order
  15. Where it breaks
  16. Payments dictionary

Now zoom into step 8 of lesson 2. One authorization request passes through three or four companies to reach the customer's bank, and the answer travels all the way back. This usually completes in a couple of seconds.

Approval is not payment. An approval tells you the account is open and the funds are available right now. The customer can still dispute the charge later, and if you never capture, the hold eventually drops off. Network rules still expect you to send a reversal (Visa asks for one within 24 hours of knowing the sale will not complete), and letting a hold lapse can cost a fee.

How long does a hold last? Card network rules set the window, and they differ by brand, by transaction type, and by merchant category. For online, customer-initiated purchases, the standard window is about 7 to 10 days depending on the brand and your processor's settings. Visa reset its framework in April 2024, setting 10 days for most card-not-present customer-initiated transactions and 5 days for merchant-initiated ones; Mastercard final authorizations run 7 days. Mastercard pre-authorizations last 30 days. American Express approvals last 7 days, and Discover's are commonly 7 to 10, depending on your processor. Many processors default to 7 days. Extended authorizations of up to 30 days exist for some merchant categories, mainly travel and rental, sometimes for an added fee. If your processor returns the date a hold expires, use it rather than hard-coding a number.

Sources for this guide

Card network rules change. Time limits, fees, and authorization windows here reflect published rules and provider documentation as of late 2026; confirm details with your processor before you build against them.

Sources

Your progress stays on this device.

Next: Lesson 4

Payment states.

The life of a payment as a state machine: created, authorized, captured, settled, refunded, and disputed.

Questions about payments? Email me. I read every note.

Payment states: a chain of states from authorized to captured to settled. AuthCapturedSettled refunded?