How to disable 3D Secure in Stripe

1const express = require('express');
2const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
3
4const app = express();
5app.use(express.json());
6
7// On-session payment with automatic exemption handling
8app.post('/api/pay', async (req, res) => {
9  try {
10    const { amount, customerId, paymentMethodId } = req.body;
11
12    const paymentIntent = await stripe.paymentIntents.create({
13      amount,
14      currency: 'usd',
15      customer: customerId,
16      payment_method: paymentMethodId,
17      confirm: true,
18      automatic_payment_methods: {
19        enabled: true,
20        allow_redirects: 'never',
21      },
22    });
23
24    if (paymentIntent.status === 'requires_action') {
25      // 3DS triggered — return client_secret for frontend handling
26      return res.json({
27        requires_action: true,
28        client_secret: paymentIntent.client_secret,
29      });
30    }
31
32    res.json({ status: paymentIntent.status, id: paymentIntent.id });
33  } catch (err) {
34    res.status(500).json({ error: err.message });
35  }
36});
37
38// Off-session charge (merchant-initiated, exempt from 3DS)
39app.post('/api/charge-saved-card', async (req, res) => {
40  try {
41    const { customerId, paymentMethodId, amount } = req.body;
42
43    const paymentIntent = await stripe.paymentIntents.create({
44      amount,
45      currency: 'usd',
46      customer: customerId,
47      payment_method: paymentMethodId,
48      off_session: true,
49      confirm: true,
50    });
51
52    res.json({ status: paymentIntent.status, id: paymentIntent.id });
53  } catch (err) {
54    if (err.code === 'authentication_required') {
55      return res.status(402).json({
56        error: '3DS authentication required',
57        payment_intent_id: err.raw.payment_intent.id,
58      });
59    }
60    res.status(500).json({ error: err.message });
61  }
62});
63
64const PORT = process.env.PORT || 3000;
65app.listen(PORT, () => console.log(`Server on port ${PORT}`));