How Long Can a Security Deposit Hold Last?

Documentation Index

Fetch the complete documentation index at: https://docs.payreque.st/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

When you collect a security deposit, you place a temporary authorization hold on the customer’s payment method instead of charging it. That hold is not open-ended — every issuer and network enforces a maximum window after which the bank automatically releases the funds and you can no longer capture them. The window depends on three things:

1. Which PSP authorized the payment (Mollie, PayPal, or Stripe)
2. Which payment method the customer used (card brand, Klarna, PayPal, etc.)
3. Whether your PSP has extended-authorization features enabled on your account

​

Quick Reference: Maximum Hold Windows

The table below shows the maximum guaranteed hold window per provider and method as supported by PayRequest. The actual captureBefore deadline returned by the PSP is what your dashboard and customer status page show.

​

Mollie

Mollie returns a captureBefore field on every authorized payment. PayRequest stores this on the deposit and uses it to drive the dashboard countdown and customer status page.

​

How the window is determined

Mollie picks the window based on the card scheme (or alternative method) the customer paid with:

• Mastercard / Cartes Bancaires → 30 days
• Visa / American Express → 7 days
• Klarna / Billie → 28 days
• Riverty → 30 days (always manual capture, full capture only)
• Vipps → 180 days
• MobilePay → 14 days

Because the card brand is not known until the customer pays, the actual deadline only becomes available after the deposit moves into the authorized state. The dashboard shows “Authorizing…” until then.

​

Hold-duration setting on the product

The deposit product’s Hold Duration field (1–28 days) sets the maximum number of days PayRequest will keep the deposit in authorized state before auto-expiring it on our side. It is not an instruction to the bank — the bank enforces its own window based on card brand. If the product Hold Duration is shorter than the bank’s window, PayRequest auto-releases the hold on the configured day. If it is longer, the bank’s window wins.

​

PayPal

PayPal authorizations work differently from cards. PayPal guarantees the funds for 3 days after authorization. From day 4 to day 29, you can call the reauthorize endpoint to extend the honor period for another 3 days. After day 29, the authorization is permanently dead.

​

How PayRequest handles this

PayRequest automates the reauthorization flow so you don’t have to track 3-day windows yourself:

1. On authorization, PayRequest sets capture_before to 72 hours from now.
2. A scheduled job (deposits:reauthorize-paypal) wakes up daily and finds any PayPal deposit whose capture_before is within the next 24 hours.
3. It calls PayPal’s /reauthorize endpoint, which returns a new authorization ID with a fresh 3-day honor period.
4. The deposit’s capture_before is pushed forward 72 hours.
5. This repeats until day 29 of the original authorization, at which point reauthorization is no longer possible.

​

Effective window

From your perspective, a PayPal deposit can be held for up to 29 days without intervention, just like a Mastercard hold. The 3-day chunking is invisible — the dashboard shows the next capture_before deadline as a rolling countdown.

​

Stripe

Stripe is the newest deposit provider. By default, Stripe card authorizations expire after 7 days. Merchants on Interchange-Plus (IC+) pricing can enable extended authorization, which lifts the ceiling to up to 30 days for supported card brands and MCC codes.

​

Default: 7 days

For Stripe accounts on blended (standard) pricing, the hold expires 7 days after authorization. PayRequest reads the real capture_before from the latest charge and surfaces it on the dashboard.

​

Extended: up to 30 days

PayRequest creates Stripe Checkout Sessions with request_extended_authorization=if_available. When the merchant is on IC+ pricing and the card brand + MCC combination is eligible, Stripe automatically extends the hold to up to 30 days. The actual deadline depends on the brand:

• Mastercard — typically 30 days
• Visa — typically 7 days (extended-auth eligibility is narrower)
• American Express — typically 7 days

The Stripe Provider Settings tab in your dashboard includes a callout explaining how to opt into IC+ pricing — you contact Stripe support directly, because each connected Standard account owns its own pricing relationship.

​

Reading the deadline

After checkout.session.completed, PayRequest’s Stripe webhook handler reads capture_before off the latest charge and writes it to the deposit. The dashboard countdown and customer status page then use that exact timestamp.

​

Choosing the right PSP for your use case

​

What happens at expiration

When a hold expires before you capture or release it:

1. PayRequest receives the expiration webhook (Mollie) or detects expiry on the next status poll (PayPal/Stripe).
2. The deposit status changes to Expired (red badge).
3. The customer’s bank releases the funds — typically within 1–3 business days, sometimes up to 7.
4. The deposit detail page disables the Capture action. Only history remains visible.

​

Setting a sensible Hold Duration on your product

The Hold Duration field on a deposit product (1–28 days) is PayRequest’s internal expiry timer. It’s useful for ensuring you don’t hold customer funds longer than needed, but it doesn’t override the bank’s window. Recommended values:

• Short stays (1–3 nights): 5–7 days
• Weekly rentals: 10–14 days
• Monthly rentals: 28 days (the maximum)
• Equipment rental: rental period + 2–3 buffer days

Always add a small buffer beyond the expected service-end date so you have time to inspect before capturing.

​

Frequently Asked Questions

​

Related Documentation