What a payment gateway does
A payment gateway is the tool that captures card or bank details from a customer during checkout and sends that information securely to the payment processor. It sits between your store and the financial system—the customer enters their card number on your website or app, the gateway encrypts it and passes it along, and then relays back whether the transaction was approved or declined.
Think of it as the digital equivalent of the card reader at a physical checkout counter. The customer hands over payment information, the gateway verifies it's safe to transmit, and the processor on the other end handles the actual money movement. Without a gateway, you would have no secure way to collect payment details at all.
The gateway also handles the format and timing of that data. It translates what your store collected into the language the processor understands, manages retries if the first attempt fails, and stores transaction records so you can see what sold and when.
Key Takeaways
- A payment gateway encrypts customer payment information and sends it to a processor; it does not hold the money or move it between accounts.
- The gateway must be integrated into your checkout page or app so customers can enter their card or bank details without leaving your store.
- Different gateways support different payment methods—some handle cards only, others add digital wallets, bank transfers, and buy-now-pay-later options.
- Gateway fees are usually per-transaction charges (a percentage plus a flat fee, or a flat fee alone) and vary widely depending on the provider and your sales volume.
- PCI compliance is a security standard that gateways help you meet; it protects customer data and is required by law for any business handling card information.
How the gateway fits into the payment flow
The sequence matters. When a customer clicks "Pay Now," the gateway captures their card details on an encrypted connection. It does not store those details on your server—that is the processor's job. The gateway immediately sends the information to your processor, which contacts the customer's bank to verify the card is real, the account has funds, and the transaction is not fraudulent.
The bank approves or declines within seconds. That response travels back through the processor to the gateway, which displays the result to the customer: "Payment successful" or "Card declined." If successful, the gateway logs the transaction, and your store receives a confirmation that can trigger an order receipt, inventory update, or shipping label.
The actual money does not move at this moment. The processor batches your transactions (usually daily) and settles them with the banks, which takes one to three business days. The gateway is the messenger; the processor is the one who arranges the transfer.
Which payment methods a gateway can handle
Not all gateways support the same payment types. Some are card-only: Visa, Mastercard, American Express, Discover. Others add digital wallets like Apple Pay, Google Pay, and PayPal, which let customers pay without typing their card number each time. A growing number also support bank transfers (ACH in the US, SEPA in Europe), buy-now-pay-later services like Affirm or Klarna, and regional methods like iDEAL or Alipay if you sell internationally.
The more methods your gateway supports, the fewer customers you lose at checkout. A customer who does not have a card but uses PayPal will abandon your cart if you only accept cards. Conversely, adding too many options can confuse the checkout flow. Most successful stores offer cards, at least one digital wallet, and one or two alternative methods that match their customer base.
Check your gateway's documentation to see which methods it supports in your country and which ones cost extra to enable. Some charge a higher percentage for digital wallets or bank transfers than for card transactions.
Gateway fees and how they are charged
Payment gateways charge you for the service of processing transactions. The most common model is a per-transaction fee: a percentage of the sale (usually 1.5% to 3.5%) plus a flat amount per transaction (often $0.20 to $0.50). A $100 sale might cost you $3.50 in fees; a $10 sale might cost $0.70.
Some gateways charge a flat monthly fee instead of per-transaction fees, which makes sense if you process a high volume. Others use a tiered model: lower percentages as your monthly volume increases. A few charge a gateway fee separate from the processor fee—meaning you pay both the gateway and the processor, which can add up quickly.
International transactions, digital wallets, and bank transfers often carry higher fees than domestic card payments. Chargebacks (when a customer disputes a charge) usually trigger an additional fee of $15 to $100 per dispute. Read the fee schedule carefully before signing up, and ask whether fees change if your sales volume grows.
PCI compliance and data security
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that any business handling card information must follow. It covers how you store data, who can access it, how you encrypt it, and how often you audit your systems. The standard exists to prevent card theft and fraud.
A payment gateway helps you stay compliant by handling the most sensitive part: it never stores the full card number on your server. Instead, it tokenizes the card—it replaces the number with a unique code that your store can use to charge the customer again without ever seeing the actual card number. This dramatically reduces your compliance burden.
If you use a gateway that is PCI Level 1 certified (the highest level), you inherit much of that security. You still have to protect your own systems, but you do not have to build encryption and tokenization from scratch. Skipping a certified gateway and trying to store card numbers yourself is illegal and exposes you to fines, lawsuits, and data breaches.
Hosted pages versus embedded checkout
Gateways offer two main ways to collect payment information. A hosted payment page redirects the customer to a page owned by the gateway (or processor) to enter their card details, then sends them back to your store. This is the safest for you because the customer never enters their card on your domain, so you have almost no PCI compliance burden.
An embedded checkout (also called a hosted form or iframe) displays the payment form directly on your checkout page, but the form itself is hosted by the gateway. The customer sees your branding and does not leave your site, which reduces cart abandonment. You still do not handle the card data directly—the gateway does—so compliance is still manageable.
A third option, building your own checkout form and sending card data to the gateway via API, is possible but requires serious security expertise and ongoing PCI audits. Most small and medium stores use hosted pages or embedded checkouts to avoid this complexity.
Choosing a gateway for your store
Start by listing the payment methods your customers expect. If most use cards, a basic card-only gateway works. If you sell internationally or to younger customers, add digital wallets and buy-now-pay-later. If you sell to businesses, consider bank transfers.
Next, compare fees across providers. A gateway that charges 2.9% + $0.30 per transaction is cheaper than one charging 3.5% + $0.50 if your average order is $50, but more expensive if your average order is $500. Calculate your expected monthly volume and total fees for each option.
Then check integration. Does the gateway work with your store platform (Shopify, WooCommerce, custom build)? Can you set it up in an hour or does it require a developer? Does it offer test mode so you can verify transactions before going live? Does it provide webhooks or APIs to automate your order workflow?
Finally, test customer support. Send an email with a question and see how fast they respond. Read reviews from other merchants on your platform. A cheap gateway with no support can cost you far more in lost sales and debugging time.
Frequently Asked Questions
Does the payment gateway hold my money?
No. The gateway passes the transaction to the processor, which settles it with the banks. Your money goes into your merchant account (held by the processor or a partner bank), not the gateway. The gateway is only the messenger.
What happens if a customer's card is declined?
The gateway receives the decline from the bank and displays an error message to the customer. The transaction is not charged. The customer can try a different card, or you can offer an alternative payment method. The gateway logs the failed attempt so you can see how many declines you get.
Can I use the same gateway for my website and my mobile app?
Yes, most gateways support both. They provide SDKs (software development kits) for mobile apps and APIs for websites. You may need a developer to integrate the mobile version, but the gateway itself handles both channels with the same merchant account.
What is tokenization and why does it matter?
Tokenization replaces a customer's card number with a unique code that only the gateway understands. Your store can use that token to charge the customer again without ever storing or seeing the actual card number. This cuts your PCI compliance work in half and makes recurring charges (subscriptions, installments) much safer.
Do I need a separate gateway and processor?
Not always. Many providers (Stripe, Square, PayPal) combine both functions—they are the gateway and the processor in one. Others are gateway-only and require you to choose a separate processor. Bundled solutions are simpler to set up; separate solutions give you more flexibility to swap one piece if you are unhappy with it.