Lesson 3 of 13
Authorization.
The round trip from merchant to issuer, what an approval really means, and how long a hold lasts.
By Nagesh Koritala 4 min read Last verified: November 2026
- Lesson 1: Improve the checkout
- Lesson 2: The checkout flow
- Lesson 3: Authorization (this lesson)
- Lesson 4: Payment states
- Lesson 5: Capture
- Lesson 6: Clearing and settlement
- Lesson 7: Cash capture
- Lesson 8: Returns and refunds
- Lesson 9: Disputes
- Lesson 10: Tokens and stored credentials
- Lesson 11: Transaction types
- Lesson 12: Complete reference
- Lesson 13: Payments compliance
Now zoom into step 8 of lesson 2. One authorization request passes through three or four companies to reach the customer's bank, and the answer travels all the way back. This usually completes in a couple of seconds.
Approval is not payment. An approval tells you the account is open and the funds are available right now. The customer can still dispute the charge later, and if you never capture, the hold eventually drops off. Network rules still expect you to send a reversal (Visa asks for one within 24 hours of knowing the sale will not complete), and letting a hold lapse can cost a fee.
How long does a hold last? Card network rules set the window, and they differ by brand, by transaction type, and by merchant category. For online, customer-initiated purchases, the standard window is about 7 to 10 days depending on the brand and your processor's settings. Visa reset its framework in April 2024, setting 10 days for most card-not-present customer-initiated transactions and 5 days for merchant-initiated ones; Mastercard final authorizations run 7 days. Mastercard pre-authorizations last 30 days. American Express approvals last 7 days, and Discover's are commonly 7 to 10, depending on your processor. Many processors default to 7 days. Extended authorizations of up to 30 days exist for some merchant categories, mainly travel and rental, sometimes for an added fee. If your processor returns the date a hold expires, use it rather than hard-coding a number.
Sources for this guide
Card network rules change. Time limits, fees, and authorization windows here reflect published rules and provider documentation as of late 2026; confirm details with your processor before you build against them.
Sources
- Visa authorization and clearing time frame changes, April 2024 (TD Bank summary)
- Checkout.com: Visa authorization processing time frames
- Stripe: Place a hold on a payment method
- Revolut: Clearing windows by card brand
- Moov: Card-not-present best practices
- Adyen: Dispute timeframes
- Cybersource: Stored credential framework (CIT, MIT, standing instructions)
- VGS: DPAN vs MPAN
- Stripe: Apple Pay merchant tokens
- Google Pay: Payment data cryptography (PAN_ONLY and CRYPTOGRAM_3DS)
- Checkout.com: Google Pay authentication methods and liability shift
- Solidgate: Why the Apple Pay card number differs from the card
- Spreedly: Payment Account Reference (PAR)
- Visa: Authorization and reversal processing best practices
- Visa: Authorization framework time frames (2024)
- Visa: Declined transaction resubmission rules
- Visa: Dispute management guidelines for merchants
- Visa: VAMP fact sheet
- Visa: Account Updater FAQ
- Mastercard: Chargeback Guide, Merchant Edition
- Mastercard AN 5524: CIT and MIT indicators (via AIB Merchant Services)
- Mastercard Gateway: Cardholder and merchant initiated payments
- Adyen: Mastercard Transaction Link Identifier
- American Express: US Disputes Reference Guide
- American Express: International Merchant Regulations
- Adyen: Adjust authorisation (validity by brand)
- Apple: Merchant tokens (MPANs)
- Apple: Payment token format reference
- Apple: Merchant Token Notification Services
- Google Pay: Merchant-initiated transactions
- Google Pay: Token lifecycle management
- Stripe: PaymentIntent lifecycle
- Stripe: Refund object
- Stripe: Dispute object
- Stripe: Subscription object
- Stripe: Decline codes
- PCI SSC: Future-dated requirements of PCI DSS v4.x
- Report URI: SAQ A changes in PCI DSS 4.0.1
- SecureTrust: PCI DSS SAQ types
- Chargeback Gurus: Regulation II and card-not-present debit
- Baymard Institute: Cart abandonment rate statistics (updated September 2025)
- Baymard Institute: The current state of checkout UX (2025)
- Baymard Institute: Checkout optimization and average form fields (2024)
- Baymard Institute: Inline form validation
- Baymard Institute: Adaptive validation error messages
- Adobe: 2025 US holiday shopping season
- US Department of Justice: Guidance on web accessibility and the ADA
- W3C: Web Content Accessibility Guidelines (WCAG) 2.2
- Apple: Human Interface Guidelines, accessibility
- Stripe: How to increase checkout conversion
- Stripe: The checkout process, reducing friction
Your progress stays on this device.
Next: Lesson 4
Payment states.
The life of a payment as a state machine: created, authorized, captured, settled, refunded, and disputed.
Questions about payments? Email me. I read every note.