Stripe event: payment_intent.requires_action, the customer must authenticate, your server cannot

paymentintent.requiresaction: hand it back to the customer

The PaymentIntent is waiting on the customer, typically 3D Secure authentication. Your server cannot complete this step no matter what it tries.

What to do on receipt

1. Read data.object.next_action. Its type tells you what the customer must do (usually use_stripe_sdk for 3DS, or redirect_to_url for bank redirects).
2. Notify the customer through whatever channel you have: email, in-app notice, SMS. Include a link that resumes your checkout flow with the PaymentIntent's client_secret.
3. On the frontend, complete with the client secret (e.g. stripe.confirmCardPayment(clientSecret)). The PaymentIntent will then move to succeeded or payment_failed, and you will get the follow-up event.
4. Do nothing else server-side. Return 200.

The trap

Treating this as a failure and emailing "your payment failed." The payment is in limbo, not dead, and telling the customer it failed sends them to a competitor. The other trap: polling the PaymentIntent in a tight loop waiting for the customer. Set a sane expiry on your resume link and let the webhook tell you the outcome.

Checklist

• This event mostly matters for off-session and server-driven flows. In a normal Stripe.js checkout, the SDK handles the action inline and you may never see this event.
• If the customer never acts, the PaymentIntent stays in requires_action until it is canceled. Decide your own abandonment window and cancel stale ones so they do not linger.

Stripe's event reference says paymentintent.requiresaction occurs when a PaymentIntent transitions to requiresaction state. Verified live at https://docs.stripe.com/api/events/types. nextaction on the PaymentIntent object is the documented carrier of what the customer must do.