What a payment gateway does and why your store needs one

A payment gateway is the software that sits between your online store and the banks that move money. When a customer enters their card number on your checkout page, the gateway encrypts that data, sends it to the card networks (Visa, Mastercard, American Express), checks with the customer's bank that the funds exist, and tells your store whether the transaction went through or failed—all in two to three seconds.

Without a gateway, you have no way to accept cards, digital wallets, or bank transfers. You also have no fraud protection, no record of what happened, and no way to refund a customer if something goes wrong. The gateway is not optional; it is the foundation that makes online payment possible.

The gateway also handles the rules that banks enforce: it checks that the card has not expired, that the billing address matches what the bank has on file, and that the transaction amount is reasonable for that card's history. If any of those checks fail, the gateway declines the charge before your store ever sees the customer's full card number.

Key Takeaways

  • A payment gateway encrypts card data, routes it to banks, and returns approval or decline within seconds—you cannot process online payments without one.
  • Popular gateways for small to mid-size stores include Stripe, Square, PayPal, and Authorize.net; each charges different fees and supports different payment methods.
  • Integration means connecting your store's checkout page to the gateway's API so transactions flow automatically without manual entry or redirects.
  • You will need a merchant account (a bank account that accepts card payments) and a processing agreement before any gateway will work with your store.
  • PCI compliance—the security standard that protects card data—is mandatory; most gateways handle it for you if you use their hosted checkout or tokenization.

Choosing a gateway that matches your store type and payment methods

Different gateways work best for different businesses. Stripe is popular with custom-built stores and subscription businesses because its API is developer-friendly and its fees are transparent (2.9% + $0.30 per card transaction in the US). Square works well for small retail and service businesses; it offers in-person card readers, online checkout, and invoicing all in one dashboard. PayPal is the oldest and most recognized; many customers trust it, but its fees are higher (2.99% + $0.30 per transaction) and it redirects customers away from your site during checkout. Authorize.net is built for high-volume merchants and integrates with most shopping carts; it charges a monthly gateway fee ($25) plus per-transaction fees.

Before you pick, decide which payment methods matter to your customers. Do you need to accept credit cards only, or also digital wallets like Apple Pay and Google Pay? Do you sell internationally and need to accept local payment methods (iDEAL in the Netherlands, Alipay in China)? Do you need to process subscriptions or one-time purchases? Stripe and Square handle all of these; PayPal and Authorize.net have limits on some. Check the gateway's documentation for the methods you need.

You will also need a merchant account—a special bank account that accepts card payments. Some gateways (Stripe, Square) set this up for you automatically. Others (Authorize.net, older PayPal setups) require you to open one separately with a bank or payment processor. Ask the gateway whether they provide the merchant account or whether you have to arrange it yourself.

How to connect your store's checkout to the gateway

Integration happens in one of three ways, depending on how much control you want and how technical your team is.

Hosted checkout is the simplest. Your store's checkout page has a button that says "Pay Now." When the customer clicks it, they are redirected to a payment page hosted by the gateway (not your site). They enter their card details there, the gateway processes the charge, and they are sent back to your store with a confirmation. You never touch the customer's card data. PayPal and Square both offer this. The downside: customers leave your site, which can feel jarring and increases cart abandonment.

Embedded forms

API integration

Understanding PCI compliance and data security

PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that banks and card networks enforce to protect customer card data. If you handle card data directly—if it passes through your servers—you must meet PCI requirements: encrypt data in transit and at rest, use secure passwords, run security scans, and document your security practices. Non-compliance can result in fines of $5,000 to $100,000 per month from your payment processor.

The easiest way to avoid PCI liability is to never touch card data yourself. Use a hosted checkout (PayPal, Square) or an embedded form (Stripe, Square) where the gateway handles encryption and storage. If you do use an API integration, use tokenization

Most gateways will certify that you are PCI-compliant if you use their hosted or embedded solutions. If you build a custom checkout, you will need to complete a PCI self-assessment questionnaire (SAQ) and possibly hire a third-party auditor. Ask your gateway what compliance level you need before you start building.

Setting up test transactions before going live

Every gateway provides a sandbox or test environment where you can send fake transactions without charging real money. Before you launch, you must test your integration in the sandbox. Use the test card numbers the gateway provides (Stripe's test card is 4242 4242 4242 4242, for example). Run through your entire checkout flow: add items to cart, enter shipping address, enter payment details, submit the form, and check that the order appears in your store's admin panel.

Test both success and failure scenarios. Use a test card that the gateway will decline (Stripe provides 4000 0000 0000 0002 for this) and confirm that your checkout shows an error message and does not create an order. Test a refund: process a charge in the sandbox, then refund it from your gateway's dashboard and confirm the refund appears in your store's order history. Test a subscription charge if you offer subscriptions: set up a test subscription, wait for the next billing cycle (most gateways let you trigger it manually in sandbox), and confirm the charge went through.

Only after all tests pass should you switch to live mode and start processing real transactions. Most gateways let you flip a switch in your settings; some require you to submit additional information (your business license, tax ID, bank account details) before they will activate live processing.

Handling payment failures and refunds

Not every transaction succeeds. A card might be declined because the customer entered the wrong expiration date, the card is expired, the bank suspects fraud, or the customer has insufficient funds. Your gateway will return a specific decline reason (expired card, insufficient funds, do not honor, etc.). Your checkout should show a clear error message and let the customer try again with a different card or payment method.

Some declines are temporary (the bank's system is slow, the customer's account is locked) and will succeed if you retry after a few seconds. Most gateways handle this automatically; they retry declined transactions once or twice before giving up. If a customer's first attempt fails, do not charge them again without their permission—let them try manually.

Refunds work differently depending on the gateway. Most let you refund a transaction from your dashboard within 24 to 90 days of the original charge. The money goes back to the customer's card within one to three business days. Some gateways charge a small fee for refunds (Stripe does not; PayPal charges 2.2% + $0.30). If a customer disputes a charge with their bank (a chargeback), the gateway will notify you and deduct the amount from your merchant account. You can dispute the chargeback by providing proof that the customer received the goods or services, but the process is slow and you usually lose.

Monitoring transactions and reconciling with your bank

Every gateway provides a dashboard where you can see all transactions: the amount, the customer, the card used, the timestamp, and the status (approved, declined, refunded, disputed). Log in regularly to spot problems: a sudden spike in declined transactions might mean your checkout is broken, or a spike in refunds might mean customers are unhappy with what they received.

Money from card transactions does not hit your bank account instantly. Most gateways hold funds for one to two business days before depositing them, a practice called settlement. During this time, the gateway is verifying that the transactions are legitimate and that no chargebacks are coming. Once settled, the money appears in your merchant account as a single deposit (not one deposit per transaction). Your bank statement will show the total, but the gateway's dashboard shows the individual transactions that make up that total.

Reconcile your gateway dashboard with your bank statement monthly. The totals should match (minus any fees the gateway charged). If they do not, check whether transactions are still pending settlement, whether refunds have not yet posted to your bank, or whether the gateway charged you a monthly fee or chargeback fee that reduced the deposit.

Frequently Asked Questions

Do I need a separate merchant account or does the gateway provide one?

It depends on the gateway. Stripe and Square set up a merchant account for you automatically when you sign up. Authorize.net and traditional payment processors require you to open a merchant account separately with a bank or third-party processor. Check the gateway's onboarding flow; if it asks for your business license and tax ID before you can process transactions, it is setting up a merchant account for you.

What happens if a customer's card is declined?

The gateway returns a decline code (expired card, insufficient funds, do not honor, etc.) and your checkout should display a clear error message. The customer can try again with the same card or a different one. Do not charge them again without their permission. If they try multiple times and keep failing, the bank might temporarily lock the card to prevent fraud.

Can I accept payments without redirecting customers to a payment page?

Yes, if you use an embedded form or API integration. Hosted checkout redirects customers away from your site, which increases cart abandonment. Stripe's Stripe.js and Square's Web Payments SDK let customers enter payment details on your checkout page without leaving. This requires a developer to install the code, but keeps customers on your site.

How long does it take for money to appear in my bank account?

Most gateways settle transactions within one to two business days, meaning the money is verified and ready to deposit. Your bank then deposits the total to your merchant account, usually within one to three business days after settlement. So from the time a customer is charged to the time money hits your account is typically two to five business days.

What if a customer disputes a charge with their bank?

The gateway will notify you of the chargeback and deduct the amount from your merchant account. You can dispute it by providing proof that the customer received the goods or services (a tracking number, delivery confirmation, or email showing they accessed a digital product). The bank decides whether to side with you or the customer. Most chargebacks favor the customer, so prevention (clear product descriptions, good customer service) is better than fighting them.