Ok, implemented server side handling of requires_action in the event Stripe JS fails to for whatever reason. When the payment is being processed it'll check if requires_action status is set and if next_action.type is set to redirect_to_url. If it is it'll redirect them to the URL provided by Stripe to finish authenticating. It's very strange Stripe didn't do this itself though as it's supposed to. Maybe the popup didn't display due to a JS error? Not sure, but this will cover cases where that could happen.

forge.joomlapolis.com/issues/9141

Once reviewed and merged a new release will be made available. Will let you know when it is. Likely sometime today or early tomorrow.

Am also contacting support about this as I was able to replicate your issue. The SetupIntent validates 3DS fine, but when attached to the Subscription the Invoice created by it creates a PaymentIntent, which fails the 3DS which doesn't make any sense.

Phew, with some back and forth with support it looks like I don't in fact need to rewrite all this. So a fix should be available sometime today or early tomorrow.

I honestly recommend you stay with Hosted Checkout as you seam to accept a lot of payments from India. The friction caused by SCA increases the chance of failed payments quite significantly. It's that or don't accept recurring payments and only accept single payments (manual renewals). Recurring payments could go into authenticate and if that happens we've no way to communicate this to them to authenticate. Next release will simply reject these and error that their payment method cannot be used for subscriptions.