# Customer-initiated and merchant-initiated transactions

Payment gateways distinguish between Customer-Initiated Transactions (CIT) and Merchant-Initiated Transactions (MIT).
How you collect payment details and whether CVV is required depends on which type of transaction you are processing.

## Customer-Initiated Transactions (CIT)

A CIT occurs when the customer is present and approves the payment, such as at checkout or when confirming a purchase in your application.

To store a payment card for later MIT charges without a purchase, run a [setup transaction](/docs/dev-docs/transactions#type) while the customer is present.

When a stored payment card requires CVV, the customer can provide it during checkout.

## Merchant-Initiated Transactions (MIT)

An MIT occurs when you or Rebilly charge the customer without the customer being present, such as a recurring payment or an [autopay](/docs/data-tables/manage-autopay) retry.

Before the first MIT, register stored credentials with the gateway during a customer-present step.
For example, run an approved CIT at checkout or a [setup transaction](/docs/dev-docs/transactions#type) when the customer is present.

Subsequent MIT charges, including recurring transactions, never include CVV.
The gateway uses stored credentials from that initial checkout or setup transaction.

In Rebilly, set `isMerchantInitiated` to `true` on [Create transaction](/catalog/all/transactions/posttransaction) when the customer is not present.
Rebilly sets merchant-initiated transactions automatically for subscription rebills and similar flows.

For [subscriptions](/docs/dev-docs/subscriptions), a setup transaction is not required.
The initial subscription payment is a CIT that stores the payment instrument and registers stored credentials with the gateway.
Rebilly then processes renewal charges as MIT automatically.
Run a setup transaction only when you store a payment card separately from checkout, such as in a billing portal.

## Register and use stored payment credentials

This process describes how to register stored payment credentials and use them for merchant-initiated and returning customer transactions.

1. Register and store payment credentials:
  - **Customer-present checkout (CIT)**: The customer completes checkout and passes 3DS or SCA during the `sale` or `authorize` transaction.
This initial payment stores the payment instrument and registers stored credentials for later MIT charges.
  - **Customer-initiated setup (without checkout)**: The customer adds a payment card and passes 3DS or SCA during a [setup transaction](/docs/dev-docs/transactions#type).
This registers stored credentials for later MIT charges but does not collect payment for a purchase.
For more information on configuring `setupInstruction`, see [Store for future use](/docs/dev-docs/payment-instruments#store-for-future-use).
2. **Recurring and off-session charges (MIT)**: After stored credentials are registered during customer-present checkout or a setup transaction, charge using `paymentInstrumentId` with `isMerchantInitiated: true`.
Do not collect or attach CVV.
Subsequent recurring transactions do not require CVV because the gateway uses stored credentials from that initial checkout or setup transaction.
3. **Returning customer checkout (CIT) with stored card**: If the gateway requires CVV, attach CVV to the payment instrument before each charge. 
If you use FramePay, use a CVV-only FramePay token with [Update payment instrument](/catalog/all/payment-instruments/patchpaymentinstrument), then create the transaction with `paymentInstrumentId` only.
Partial CVV tokens cannot be passed on [Create transaction](/catalog/all/transactions/posttransaction).
For more information, see [Charge a stored payment instrument with CVV](/docs/dev-docs/update-payment-instruments#charge-a-stored-payment-instrument-with-cvv).


## CVV and stored payment cards

Rebilly does not store CVV values on payment instruments.
To comply with [PCI DSS](/docs/pci-compliance), CVV is cached only until it is sent to the payment gateway for a single charge attempt.

Payment gateways and card networks often require fresh CVV verification for customer-initiated charges, even when the card number is already stored.
As a result, customers may need to enter their CVV again at checkout when paying with a stored payment card.

For Customer-Initiated Transactions (CIT), the customer is present and can provide CVV when the payment gateway or card network requires it.

A gateway or card issuer may approve a CIT without CVV.
Approval depends on the gateway, card issuer, and the transaction risk profile.

For higher approval rates, it is strongly recommended to collect CVV for CIT charges.
If you are unsure whether to collect CVV, especially for a subsequent CIT with a stored card, consult your gateway provider.

For Merchant-Initiated Transactions (MIT), including recurring charges, subsequent transactions do not require CVV.
Register stored credentials before the first MIT using a [setup transaction](/docs/dev-docs/transactions#type) or an approved CIT with [Strong Customer Authentication (SCA)](/docs/glossary#strong-customer-authentication-sca) when required.
The gateway uses those stored credentials for later MIT charges.

Do not pass a CVV on MIT transactions.
If MIT charges decline, verify that the payment instrument was set up correctly and that the gateway account supports stored credentials for merchant-initiated payments.

After each charge attempt, Rebilly clears CVV from the payment instrument.

## Related topics

- [Integrate payment forms](/docs/dev-docs/get-started-integrate-payment-forms)
- [Deposits and payouts](/docs/dev-docs/deposits-and-payouts)
- [FramePay](/docs/dev-docs/framepay)
- [FramePay — Charge a stored payment instrument with CVV](/docs/dev-docs/update-payment-instruments#charge-a-stored-payment-instrument-with-cvv)
- [FramePay — Use encrypted CVVs for payment instruments](/docs/dev-docs/use-framepay-encrypted-cvv)