# Stripe: verify before you capture

## The mechanism

Create the PaymentIntent with `capture_method` set to `manual`. Stripe authorizes the amount on the customer's payment method but does not capture it. You get a window to check everything before money moves. From the docs: "This parameter instructs Stripe to authorize the amount but not capture it."

```
curl https://api.stripe.com/v1/payment_intents   -u [your test secret key]   -H "Idempotency-Key: [unique value]"   -d amount=2000   -d currency=usd   -d capture_method=manual   -d customer=[customer id]
```

## The verification step

Before capturing, retrieve the PaymentIntent fresh from the API and check all four, independently of whatever your code computed earlier:

1. `amount` matches the order total from your own order record, recomputed, not passed through.
2. `currency` matches the customer's expected currency.
3. `customer` is the right customer id.
4. Status is `requires_capture`. If it is anything else, do not capture; investigate.

```
curl https://api.stripe.com/v1/payment_intents/[payment intent id]   -u [your test secret key]
```

Only then capture:

```
curl -X POST https://api.stripe.com/v1/payment_intents/[payment intent id]/capture   -u [your test secret key]   -H "Idempotency-Key: [unique value for the capture]"
```

## Why this matters for agents

Agents compose values across function calls, and a wrong variable upstream becomes a wrong charge downstream. The retrieve-and-compare step breaks that chain: the API is the source of truth, not the agent's memory of what it sent. For live money, pair this with the human approval gate skill.

## Notes

- Uncaptured authorizations expire (about 7 days for card payments). Capture or cancel; do not leave holds dangling.
- Partial capture is supported if you need less than the authorized amount.