What a payment gateway does and why you need one
A payment gateway is the technology that takes a customer's payment information—credit card, debit card, digital wallet, or bank account—and sends it securely to the bank or payment processor that actually moves the money. Think of it as the checkout counter between your customer and the financial system. Without a gateway, you have no way to collect payments online or over the phone.
When a customer enters their card details on your website or app, the gateway encrypts that information, checks it's valid, and routes it to your payment processor and the customer's bank. The processor and bank decide whether to approve or decline the transaction in seconds. The gateway then tells your system whether the payment went through, so you know whether to complete the order.
Most small businesses use a gateway provided by a payment processor like Stripe, Square, or PayPal. Larger businesses sometimes build their own or use a dedicated gateway company. Either way, the gateway is what makes the transaction possible.
Key Takeaways
- A payment gateway encrypts customer payment information and routes it to banks and processors, then reports back whether the transaction was approved.
- Most businesses use a gateway built into a payment processor like Stripe or Square rather than building one from scratch.
- You need a merchant account with a bank or processor before you can connect a gateway to your website or app.
- The gateway charges a fee per transaction, usually between 2 and 3 percent plus a fixed amount, though rates vary by processor and card type.
- PCI compliance—a security standard for handling card data—is required by law, and most gateways handle it for you automatically.
How to choose between gateway providers
The main payment processors that offer gateways are Stripe, Square, PayPal, Authorize.net, and Shopify Payments (if you use Shopify). Each one handles the same basic job but differs in pricing, ease of setup, and what features come built in.
Stripe and Square are the most common for new businesses because they charge straightforward per-transaction fees (usually 2.9% plus 30 cents for online card payments) and don't require a long-term contract. Stripe is stronger if you need to build a custom checkout experience or handle recurring billing. Square is stronger if you also want to accept in-person payments with a card reader.
PayPal's gateway works similarly but ties you to PayPal's ecosystem—customers see PayPal branding and may be redirected to PayPal's site to complete payment. Authorize.net is older and more common in enterprise settings. Shopify Payments is the cheapest option if you already run your store on Shopify, because Shopify owns the processor and doesn't mark up the rate.
Before you sign up, check the processor's pricing page for your card type (Visa, Mastercard, American Express, debit cards) and your business type (online, in-person, recurring). Rates vary, and a processor that's cheap for online credit cards might be expensive for American Express or debit cards.
What you need before you can integrate a gateway
You need a merchant account before any gateway will work. A merchant account is a contract between you and a bank or payment processor that lets you accept card payments. The processor or bank holds the money temporarily, deducts their fees, and deposits the rest into your business bank account.
To open a merchant account, you'll need to provide your business name, tax ID or Social Security number, business address, and bank account details. The processor will run a background check and may ask for bank statements or proof of business registration. The process usually takes one to three business days.
Once you have a merchant account, the processor gives you credentials—usually an API key and a secret key—that you use to connect the gateway to your website or app. If you use a platform like Shopify, WooCommerce, or Square Online, the gateway is already built in and you just log in with your merchant account credentials.
How to integrate a gateway into your website or app
The steps depend on whether you built your own website or use a platform. If you use Shopify, WooCommerce, BigCommerce, or another e-commerce platform, the gateway is usually already connected—you just log in with your merchant account details and turn it on. The platform handles all the technical work.
If you built a custom website or app, you'll need a developer to integrate the gateway's API. The processor provides code libraries and documentation for common languages like JavaScript, Python, and PHP. A developer reads the documentation, writes code that sends payment information to the gateway, and tests it in a sandbox environment (a fake version of the system where you can test without real money).
The integration usually takes a few hours to a few days depending on how complex your checkout is. Once it's live, the gateway handles encryption and security automatically—you never see the customer's full card number, which is why you don't have to worry as much about PCI compliance yourself.
Understanding payment gateway fees
Payment gateways charge a fee for every transaction. The fee structure varies by processor but usually includes a percentage of the transaction amount plus a fixed amount per transaction.
| Processor | Online Card Payment Fee | In-Person Card Fee | ACH Bank Transfer Fee |
|---|---|---|---|
| Stripe | 2.9% + $0.30 | 2.7% + $0.05 | 1% (capped at $5) |
| Square | 2.9% + $0.30 | 2.6% + $0.10 | 1% (capped at $5) |
| PayPal | 3.49% + $0.49 | 2.7% + $0.05 | 1% (capped at $5) |
| Shopify Payments | 2.9% + $0.30 | 2.7% + $0.05 | 1% (capped at $5) |
On a $100 online credit card payment, Stripe charges $3.20 (2.9% of $100 plus $0.30). On a $100 ACH bank transfer, Stripe charges $1.00. American Express and debit cards often cost more. Some processors charge extra for chargebacks (when a customer disputes a charge) or monthly account fees, so read the full pricing page before you commit.
The fee is deducted from the payment before it reaches your bank account. If a customer pays $100, you receive $96.80 (on Stripe), not $100. This is normal and expected—the processor is taking a cut for handling the transaction securely.
PCI compliance and security
PCI compliance is a set of security rules that any business handling card payments must follow. The rules are set by the major card networks (Visa, Mastercard, American Express) and enforced by banks and processors. If you don't comply, you can be fined thousands of dollars per month or lose the ability to accept cards.
The core rule is straightforward: never store a customer's full card number on your own servers. If you use a payment gateway, the gateway handles this for you—the customer's card data goes straight to the gateway's encrypted servers, and your system never sees it. This is called tokenization. The gateway gives you a token (a random string) that represents the card, and you store the token instead of the card number.
If you build a custom checkout, you must use the gateway's hosted payment form or iframe, not a form you built yourself. You must also use HTTPS (the find version of HTTP) on every page where payment happens. Most gateways handle PCI compliance automatically if you follow these rules. You don't need to pass a separate audit unless you're a very large business.
What happens after the payment is approved
When a payment is approved, the gateway sends a confirmation to your system, which updates your order status and triggers the next step—sending a confirmation email, starting fulfillment, or unlocking access to a digital product. The money doesn't arrive in your bank account when ready. Most processors deposit funds one to two business days later, though some offer next-day or same-day deposits for an extra fee.
If a payment is declined, the gateway tells your system why—insufficient funds, card expired, address mismatch, or fraud detection. Your checkout page should show the customer a clear message and let them try a different card. Some gateways offer a retry feature that automatically asks the customer to update their payment method if the first attempt fails.
You can see all transactions in your processor's dashboard, which shows the amount, the customer, the card type, the timestamp, and the status. You can also read transaction reports for accounting or tax purposes. Most processors keep transaction records for at least seven years.
Frequently Asked Questions
Do I need a separate gateway if I already use PayPal?
No. PayPal includes a payment gateway, so you can accept credit cards through PayPal without signing up for another processor. However, PayPal's rates are higher than Stripe or Square, and customers see PayPal branding. Many businesses use PayPal for invoices and Stripe for their website checkout to give customers more options.
Can I use multiple gateways on the same website?
Yes. You can offer customers a choice between Stripe, PayPal, Apple Pay, Google Pay, and other methods on the same checkout page. This requires more setup, but it reduces the chance a customer will abandon their order because their preferred payment method isn't available. Most e-commerce platforms support multiple gateways.
What if a customer disputes a charge?
The customer contacts their bank and files a chargeback, claiming they didn't recognize the charge or didn't receive the product. The processor notifies you and deducts the amount from your account. You can dispute the chargeback by providing proof of delivery or a signed receipt. If you lose, you pay the chargeback fee (usually $15 to $100) plus the transaction amount. This is why keeping order confirmations and shipping records is important.
How long does it take to get paid after a customer pays?
Most processors deposit funds one to two business days after the transaction is approved. Some offer next-day or same-day deposits for an extra fee. Weekends and holidays can delay deposits. You can see the expected deposit date in your processor's dashboard when the payment is approved.
What's the difference between a payment gateway and a payment processor?
A payment gateway is the technology that encrypts and routes payment information. A payment processor is the company that handles the transaction with the banks. Most of the time, one company (like Stripe or Square) provides both, so the distinction doesn't matter to you. But technically, the gateway is the software and the processor is the service.