Set up two-party approvalsPrivate preview

With approval rules, administrators can conditionally require two-party approval for sensitive actions in your account.

When an action triggers an approval rule, the action is interrupted and an approval request is created. A designated reviewer approves or denies the request. Approved actions are completed automatically; denied actions are discarded with no changes made.

Supported actions

You can require approval for the following actions:

• Bank account is added, updated or deleted
• Admin is invited to account
• Payment intent is created
• Invoice is created
• Refund is created
• Subscription is created or canceled
• Credit note is created
• Customer balance transaction is created
• Outbound payment is created
• Outbound transfer is created
• Inbound transfer is created
• Payout is created
• Currency conversion is created
• Approval rule is created, updated or deleted

Create an approval rule

1. Go to Settings > Approvals.
2. Click Create rule, then select the action that triggers the approval. By default, only team members with the Administrator role can create or edit approval rules. You can optionally create a rule to require designated reviewers for creating or updating approval rules.
3. (Optional) Click Add condition to add one or more trigger conditions. If you add multiple conditions, you can combine them with and or or. For example:
   • Amount condition: Require approval for a refund only if the amount exceeds a threshold.
   • Actor condition: Require approval for actions taken by team members or agent-tagged API keys.
4. Set the control:
   • Require approval: The action is paused until a reviewer approves it.
   • Block: The action is rejected outright.
5. Choose designated reviewers: individual team members, or all team members with an assigned role, such as Administrator, Analyst, or Support specialist. Only individually assigned team members receive email notifications when an action requires their review.
6. Optionally, define custom justification instructions for requesters that appear when they request a sensitive action, so they can submit proper justification.
7. Optionally, enter a name for the rule.
8. Click Activate to save and enable the rule immediately, or Save changes to save it as inactive.

You can activate, deactivate, or delete rules at any time from the Approvals settings page. Only one active rule can apply to a given action.

Review approval requests

Designated reviewers can approve or deny requests in the Dashboard under Settings > Approvals > Requests. Use the filters to view requests by status, then click a request to view its details and respond. Requests that haven’t been approved within 14 days expire automatically.

When a request is approved, the action completes automatically. When denied, no changes are made. A user can’t approve their own request.

Default rules for agent-tagged API keys

Stripe maintains default approval rules for the following sensitive actions taken by agent-tagged API keys:

• Refund is created
• Subscription is canceled
• Outbound payment is initiated
• Outbound transfer is initiated
• Inbound transfer is initiated
• Payout is created
• Currency conversion is created

You can modify conditions or designated reviewers for default rules, or delete them in the Approvals settings.

Handle API requests from agent-tagged API keys that require approval

When an agent-tagged API key attempts an action that triggers an approval rule, Stripe returns an approval_required error and automatically submits an approval request for review.

Add a justification

To programmatically attach a justification, update the approval request:

curl -X POST https://api.stripe.com/v2/core/approval_requests/apreq_1R4kXn2eZvKYlo2C/update \
  -H "Authorization: Bearer sk_test_Hrs6SAopgFPF0bZXSN3f6ELN" \
  -H "Stripe-Version: 2026-07-29.preview" \
  --json '{
    "reason": "Customer support request for Jenny Rosen"
  }'

Monitor approval activity

Approval events appear in Security history under Settings > Team and security. The following events are logged:

• Approval rule created, updated, activated, deactivated, or deleted
• Approval request created, approved or denied

You can also view API requests where approval was required from Logs in Workbench. Click an API request to view it.

Webhooks and events

Approval requests are reviewed asynchronously. Listen for these events to handle outcomes in your integration.

Accounts with a single team member

Two-party approval requires the approver to be different from the requestor. On single-user accounts, you can only save two-party approval rules where the actor condition is set to agent-tagged API keys, because an agent API key is an independent actor from the administrator of the account.