What a payment gateway actually does on your site
A payment gateway is the software that sits between your checkout page and the bank or card network. When a customer enters their card number, the gateway encrypts it, sends it to the processor, waits for approval or decline, and tells your site whether to complete the order. You do not handle the card data yourself — the gateway does, which is why you need one before you can take payments online.
The gateway is separate from the merchant account (the bank account that receives the money) and separate from the processor (the company that talks to Visa, Mastercard, and the customer's bank). Some providers bundle all three; others let you pick and mix. The choice affects your fees, your support options, and how quickly money lands in your account.
Key Takeaways
- You need a merchant account with a bank or payment processor before any gateway can work; the gateway alone cannot move money.
- Hosted gateways (like Stripe or Square) handle security and compliance for you; self-hosted gateways require you to meet PCI compliance standards yourself.
- Monthly fees, per-transaction fees, and setup costs vary widely — compare the total cost for your expected transaction volume, not just the headline rate.
- Test the gateway's API documentation, webhook support, and refund process before signing up, because switching later means recoding your checkout.
- Your payment gateway choice affects which payment methods you can offer (cards, ACH, digital wallets, buy-now-pay-later) and which countries you can accept from.
Hosted gateways versus self-hosted: which route fits your site
A hosted gateway redirects the customer to a payment page you do not control — you send them to Stripe, PayPal, or Square, they enter their card, and the gateway sends the result back to your site. You never touch the card data. The trade-off is less control over the look and feel of checkout, and a redirect that can increase cart abandonment.
A self-hosted gateway keeps the customer on your site the whole time. The card form sits on your checkout page, but the gateway's code encrypts the data before it leaves the browser — you still never see the raw card number. This requires you to meet PCI DSS compliance (Payment Card Industry Data Security Standard), which means annual security audits, firewalls, encrypted storage, and documented procedures. The compliance cost and complexity often outweigh the checkout experience gain for small sites.
Most new sites start with a hosted gateway because the provider handles compliance. As transaction volume grows and checkout experience becomes a competitive factor, some move to self-hosted. The decision hinges on whether the extra engineering and compliance cost is worth keeping customers on your domain during payment.
The merchant account: what you need before the gateway works
The payment gateway cannot move money without a merchant account — a special bank account that receives card payments. You open this with a bank, a payment processor, or sometimes the gateway provider itself. The merchant account is where fees are deducted and where your revenue lands, usually one to two business days after the transaction.
To open a merchant account, you typically need a business license, an EIN (Employer Identification Number) or Social Security Number, a business bank account, and sometimes proof of your site's traffic or sales history. Some providers (Stripe, Square, PayPal) let you open the merchant account and gateway in one step; others require you to set up the account separately and then connect the gateway to it.
Underwriting can take a few days to a few weeks. During that time, the gateway is live but cannot process payments. Ask the provider upfront what documents they need and how long approval typically takes — this affects your launch date.
Comparing fees: what actually costs money
Payment gateways charge in three ways: a percentage of each transaction (usually 2.2% to 3.5% for card payments), a flat per-transaction fee (often $0.25 to $0.50), and sometimes a monthly account fee ($0 to $50). Some providers also charge for refunds, chargebacks, or failed transactions. A few charge setup fees or annual fees.
The total cost depends on your mix of transactions. A site processing $10,000 a month in card payments might pay $300 to $400 in fees with one provider and $250 to $350 with another — the difference matters. ACH transfers (bank-to-bank) usually cost less per transaction but take longer to settle. Digital wallets (Apple Pay, Google Pay) often cost the same as cards but convert better, so the lower abandonment can offset the fee.
Request a fee schedule in writing before you commit. Ask specifically about refund fees, chargeback fees, and whether rates change if your volume grows. Some providers offer volume discounts; others do not. Calculate your expected monthly cost based on realistic transaction volume, not best-case volume.
Which payment methods your gateway can handle
Not every gateway supports every payment method. Most handle credit and debit cards (Visa, Mastercard, American Express, Discover). Many also support ACH transfers, digital wallets (Apple Pay, Google Pay, PayPal), and buy-now-pay-later services (Affirm, Klarna). International gateways may support local methods like iDEAL (Netherlands), Giropay (Germany), or WeChat Pay (China).
If you want to offer installment payments or ACH, check the gateway's documentation before signing up — some providers do not support these, or support them only in certain countries. The same applies if you sell internationally; some gateways block transactions from specific regions or require additional compliance steps.
Your choice of gateway constrains your payment options for the life of your site, because switching means recoding your checkout. Decide what methods your customers need now and what you might add in the next two years, then pick a gateway that supports all of them.
Integration: API, plugins, and how the gateway talks to your site
Most gateways offer three ways to connect: a plugin (for Shopify, WooCommerce, or other platforms), a pre-built form you can drop into your site, or an API you code against yourself. Plugins are fastest if you use a supported platform. Pre-built forms work if your checkout is simple. An API gives you the most control but requires a developer.
Before you choose a gateway, read the API documentation. Look for clear examples, webhook support (so the gateway can tell your site when a payment succeeds or fails), and a sandbox environment where you can test without real money. Poor documentation means slower development and more support tickets.
Ask the provider about their refund process: can you refund through the API, the dashboard, or both? How long does a refund take to appear in the customer's account? Can you refund partial amounts? These details matter when something goes wrong and you need to move fast.
Security and compliance: what you are responsible for
With a hosted gateway, the provider handles most compliance — they store the card data, encrypt it, and manage the security audits. You are responsible for keeping your site's HTTPS certificate current, not storing card data yourself, and following the provider's terms. This is much simpler than self-hosted.
With a self-hosted gateway, you must meet PCI DSS compliance yourself. This means annual security audits (which cost $1,000 to $5,000 or more), encrypted storage of any data you do keep, network firewalls, regular security patches, and documented incident response procedures. Many small sites find this cost prohibitive and choose hosted instead.
Either way, never store a full card number, expiration date, or CVV on your servers — the gateway handles that. Store only a token (a unique reference the gateway gives you) if you need to charge the same card again later. Tokens are safe; raw card data is not.
Testing, launch, and what to monitor after go-live
Most gateways provide a sandbox environment where you can test transactions with fake card numbers. Use it to test success, decline, and error scenarios. Test refunds, partial refunds, and chargebacks if the gateway supports them. Test on mobile and desktop. Test with different card types (Visa, Mastercard, Amex) if your gateway supports them.
Before launch, run a few real test transactions with small amounts (usually $1 or less) to confirm the live environment works. Check that your confirmation emails send, that your order records the transaction ID correctly, and that the money appears in your merchant account on the expected timeline.
After launch, monitor your transaction success rate (the percentage of attempts that complete). A rate below 95% usually signals a problem — either your checkout flow is confusing customers, or the gateway is declining legitimate cards. Check your gateway's dashboard weekly for the first month, then monthly after that. Set up alerts for failed transactions or chargebacks so you can respond quickly.
Frequently Asked Questions
Can I use the same gateway if I move my site to a different platform?
Most gateways work across platforms because they use APIs or webhooks, not platform-specific plugins. However, if you built a custom integration, moving platforms means recoding the checkout. Hosted gateways (Stripe, Square) are easier to move than self-hosted ones because you do not have to migrate compliance infrastructure.
What happens if a customer disputes a charge?
The customer's bank initiates a chargeback, and the gateway notifies you. You have a window (usually 7 to 10 days) to respond with proof the transaction was legitimate — an order confirmation, shipping receipt, or customer communication. If you do not respond or the bank sides with the customer, the money is reversed and you pay a chargeback fee (usually $15 to $100).
How long does money take to reach my bank account?
Most gateways settle transactions one to two business days after they complete. Some offer next-day or same-day settlement for a higher fee. Weekends and holidays extend the timeline. Check your gateway's settlement schedule before launch so you know when to expect the money.
Do I need a separate gateway for international payments?
Not necessarily. Many gateways (Stripe, Adyen, Wise) process international cards and local payment methods in multiple countries. However, some gateways block certain regions or require additional compliance steps. Check the gateway's coverage map before signing up if you plan to sell internationally.
What if my gateway provider shuts down or raises fees dramatically?
You can switch to a different gateway, but it requires recoding your checkout integration. To minimize switching costs, choose a gateway with clear API documentation and avoid building custom code that only works with one provider. Keep your integration simple enough that moving to a competitor takes days, not weeks.