Pre-authorization allows merchants to block an amount on a customer’s bank account and accept the payment only after fulfilling the order. The Cashfree payment gateway supports Pre Auth for Mastercard and Visa credit/debit cards.

The Pre Auth flow lets you authorize any amount on a customer’s card and capture it (fully or partially) later. This is different from regular transactions, where funds are captured immediately after authorization.

Cashfree PG also allows you to void authorizations or uncaptured transactions, returning the blocked funds to the customer’s card. Both void and capture can be performed manually via the merchant dashboard.

Note

  • Pre-auth transactions are marked with the txMsg parameter as PRE_AUTH|.... Check if the txMsg starts with PRE_AUTH
  • You can capture or void a transaction only once, within seven days of the transaction date
  • Captured transactions cannot be voided, and voided transactions cannot be captured
  • Funds for transactions not captured within seven days are automatically returned to the customer
  • Funds for voided transactions are credited back to the customer immediately
  • Only the full payment amount can be captured, and it is settled in the next cycle

Once the pre-authorization workflow is activated for your account, you will need to ensure that you capture or void every eligible payment on this workflow.

Payment instruments

We support pre-authorized workflow on Cards and UPI. Please fill out the Support Form to enable this workflow for your account.

​
Step 1 (Payment)

If the pre-authorization workflow is enabled for your account, you might need to provide additional details to Cashfree in the /orders/pay request. This is specific to UPI (and you don’t need to send these details for card based pre-authorization workflow).
In case of UPI, once you have created the order, you will need to call Order Paywith the following details.

The following parameters have been added to the upi object - authorize_only, authorization. The authorization object contains the following attributes

  1. approve_by - The time by when customer needs to approve this one time mandate request
  2. start_time - The time when the mandate should start
  3. end_time - The time until when the mandate hold will be on customer’s bank account. You can call capture and void until this time.

​
UPI Collect

curl --request POST \
  --url https://api.cashfree.com/pg/orders/sessions \
  --header 'Content-Type: application/json' \
  --data '{
	"payment_session_id": "HTIdYxfOYgqKyYM3rLCZ",
	"payment_method" : {
		"upi" : { 
			"channel": "collect",
			"upi_id": "rohit@okicici",
			"authorize_only": true,
			"authorization" : {
          "approve_by": "2022-02-08T19:20:12+05:30",
          "start_time": "2022-02-09T12:34:34Z",
          "end_time": "2022-02-10T12:34:34Z"
       }			
		}
	}
}'

​
UPI Intent

curl --request POST \
  --url https://api.cashfree.com/pg/orders/sessions \
  --header 'Content-Type: application/json' \
  --data '{
	"payment_session_id": "HTIdYxfOYgqKyYM3rLCZ",
	"payment_method" : {
		"upi" : { 
			"channel": "link",
			"authorize_only": true,
			"authorization" : {
          "approve_by": "2022-02-08T19:20:12+05:30",
          "start_time": "2022-02-09T12:34:34Z",
          "end_time": "2022-02-10T12:34:34Z"
       }			
		}
	}
}'

​
Capture

The capture workflow helps you to capture the payment and move it from customers bank account to your bank account.

curl --request POST \
  --url https://api.cashfree.com/pg/orders/:order_id/authorization \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: <<api_version>>' \
  --header 'x-client-id: <<app_id>>' \
  --header 'x-client-secret: <<secret_key>>' \
  --data '{
  "action": "CAPTURE",
  "amount": "2.00"
}'

Partial capture

We support partial capture for UPI and card payments.

​
Void

The void workflow helps you to refund the payment back to the customer and not bear any cost on it. Please note that you can only void the entire payment.

curl --request POST \
  --url https://api.cashfree.com/pg/orders/:order_id/authorization \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: <<api_version>>' \
  --header 'x-client-id: <<app_id>>' \
  --header 'x-client-secret: <<secret_key>>' \
  --data '{
  "action": "VOID"
}'