Audit my payment flow for Strong Customer Authentication (3D Secure) handling. This is mandatory for most European cards and appears for risky transactions elsewhere: the bank pops a confirmation step, and the payment goes nowhere until the customer completes it. Verify and fix: my payment integration uses the provider's SCA-ready flow (PaymentIntents or Checkout on Stripe, not legacy one-shot charge APIs that can't handle authentication); the frontend handles the requires_action state by presenting the bank's authentication challenge (the provider's JS handles the modal; confirm my code actually calls it and waits for the result instead of assuming success or failure immediately); asynchronous completion is handled (some authentication finishes after the customer leaves; the webhook carries the final state, so fulfillment must key off webhooks, not the immediate response); and failed or abandoned authentication leaves a clear retry path (a 'confirm your payment' email or a re-prompt on next login, not a dead order). Don't treat an immediate API response as final; SCA payments resolve asynchronously. Don't mark orders paid on requires_action. Deliver: the SCA-ready flow, the requires_action handling, the async completion path, and verification with the provider's test cards: one card that requires 3DS (complete the challenge, confirm fulfillment), one where the challenge fails (order stays unpaid, retry works).