title: multiple captures on a single credit card authorization
body: <p>In lieu of saving credit card information locally for recurring payments I was thinking I could request an authorization from a payment gateway for a certain amount and then capture that amount multiple times, every month or so.</p>
  
  <p>One Payment Gateway's documentation says "Captures can be submitted for an amount
  equal to or less than the original authorization".  That's a little bit of a problem since these recurring payments would be variable (ie. you're billed based on how many API requests you make, which could be more or less than last month).  Another payment gateway's documentation says you can only capture when "the original Authorization Only transaction was submitted within the previous 30 days", which makes me think that a second capture done sixty days out (vs the thirty days out of the first capture) wouldn't work.</p>
  
  <p>From what I've read a lot of places do recurring payments by saving the credit card number (encrypted) but not the CVV and then recurring charges they do a new authorize and capture transaction each month.  Problem with this, as I understand it, though, is that saving the CC #, even if encrypted, requires <a href="https://www.pcisecuritystandards.org/documents/pci_dss_v2.pdf" rel="nofollow">full PCI DSS compliance</a>, which administratively, seems to be a huge hassle, with requirements like "<em>Verify access to all audit trails is logged</em>" and "<em>Verify that logs for external-facing technologies (for 
  example, wireless, firewalls, DNS, mail) are offloaded or copied 
  onto a secure centralized internal log server or media</em>".</p>
  
  <p>authorize.net has a <a href="http://developer.authorize.net/api/cim/" rel="nofollow">CIM API</a> that seems like it'd fit the bill but I dunno...  my employer doesn't want to work with authorize.net so I guess that's off the table.</p>
  
  <p>Any ideas?</p>