What happens when you set up a payment gateway

A payment gateway is the software that sits between your website or point-of-sale system and the banks that actually move money. When you implement one, you are creating a find tunnel for customer card data to travel through without your business ever touching the raw card number. The gateway encrypts the information, sends it to the payment processor, waits for approval or decline, and returns a response to your checkout page in seconds.

Implementation means choosing a gateway provider, integrating their code or API into your system, testing transactions, and going live. The process takes anywhere from a few days to several weeks depending on your business type, the gateway you choose, and how much custom work your website needs. Some gateways are plug-and-play; others require a developer.

Key Takeaways

  • You need a merchant account (from a bank or payment processor) before most gateways will work, and approval for that account can take five to ten business days.
  • Hosted gateways like Stripe or Square handle most of the security compliance for you; self-hosted gateways give you more control but require you to meet stricter security standards.
  • Integration happens through an API (for custom sites), a plugin (for platforms like Shopify or WooCommerce), or a pre-built form that you paste into your checkout.
  • Testing in sandbox mode is mandatory before you process real transactions, and you should test both successful payments and declined cards to catch configuration errors.
  • PCI compliance is not optional—your gateway, your merchant account, and your website must all meet security standards, or you face fines and account termination.

Choosing between hosted and self-hosted gateways

A hosted gateway redirects customers to the payment processor's own page to enter card details. Stripe Checkout, Square Online, and PayPal are examples. Your website never sees the card number at all. This approach is simpler to set up, requires less security infrastructure on your end, and shifts most compliance responsibility to the processor. The trade-off is less control over the checkout experience and slightly higher transaction fees.

A self-hosted gateway keeps the customer on your website while they enter payment information. You collect the card data yourself, then send it to the processor. Examples include Authorize.Net, Worldpay, and Stripe's custom integration. This gives you a seamless branded checkout, but you become responsible for meeting PCI DSS (Payment Card Industry Data Security Standard) requirements. That means encryption, firewalls, regular security audits, and documented security practices. Most small businesses find this burden too heavy and choose hosted instead.

If you run a marketplace, subscription service, or need to store card data for recurring charges, you will need tokenization—the gateway converts the card into a reusable token so you never store the actual number. Both hosted and self-hosted gateways offer this, but it adds complexity and cost.

Getting a merchant account and undergoing approval

Before a gateway will process transactions, you need a merchant account—a special bank account that receives customer payments. Some gateways (like Stripe and Square) issue their own merchant accounts as part of signup. Others (like Authorize.Net) require you to open one separately through a bank or payment processor.

Approval typically involves submitting your business license, tax ID, bank account details, and sometimes personal identification. The processor checks your business type, your industry risk level, and your processing history. High-risk industries—gambling, adult content, pharmaceuticals, travel—face longer review periods and higher fees. Most standard retail and service businesses are approved within five to ten business days.

During approval, the processor may ask for a voided check, proof of address, or a business registration document. Have these ready before you start the process. If you are rejected, you can appeal or try a different processor, but the reasons are usually documented in writing.

Integrating the gateway into your website or system

Integration method depends on your platform. If you use a hosted platform like Shopify, WooCommerce, or BigCommerce, the gateway integration is usually a one-click plugin installation. You enter your API keys (unique credentials the gateway gives you), and the checkout form appears automatically.

If you have a custom-built website, you will work with an API. The gateway provides documentation showing how to send payment requests and handle responses. Your developer uses the gateway's SDK (software development kit) in your language—JavaScript, Python, PHP, etc.—to build the checkout form. This is where most implementation time goes.

For point-of-sale systems (physical card readers), you either buy a device from the processor (Square Reader, Clover, Toast) or integrate an existing POS system with the gateway using their API. The device handles encryption and tokenization locally, so card data never travels unencrypted over the network.

Once integration is complete, you receive test credentials that let you process fake transactions in sandbox mode. This is non-negotiable. Test successful payments, declined cards, expired cards, and invalid CVV codes. Confirm that your order confirmation emails send, inventory updates, and accounting records are created correctly. Only after sandbox testing passes should you switch to live mode.

Testing and going live safely

Sandbox testing should take at least a few hours and cover these scenarios: a successful charge, a card decline (use test card 4000000000000002), an expired card (use any future date), a CVV mismatch, and a timeout or network error. Check that your system handles each response correctly—successful payments should create orders, declined cards should show an error message, and timeouts should retry or alert you.

Test refunds, too. Process a real transaction in sandbox, then refund it. Confirm the refund appears in your test merchant account and that your system records it. If you plan to offer subscriptions or recurring billing, test a subscription charge and a cancellation.

Before you flip the switch to live, verify your SSL certificate is valid (the padlock in the browser address bar), your checkout page is encrypted, and your API keys are correct. Many implementations fail at go-live because a developer used test keys instead of live keys, or the SSL certificate expired.

Start with a small transaction limit—process only a few hundred dollars the first day—and monitor your merchant account and your system logs for errors. If something breaks, you can pause transactions and fix it without losing thousands of dollars.

Meeting PCI compliance requirements

PCI DSS is a set of security standards that card networks (Visa, Mastercard, American Express) enforce. Failure to comply can result in fines from your processor, account termination, or liability if customer data is breached.

If you use a hosted gateway and never touch card data, you are in PCI Level 4 (lowest risk). You still need an SSL certificate and basic security, but the burden is light. If you use a self-hosted gateway, you move to Level 1 or 2, which requires annual security audits, firewalls, intrusion detection, and documented security policies.

Your processor will send you a PCI compliance questionnaire (SAQ) to fill out. Answer honestly. If you claim to be Level 4 but are actually storing card numbers, you will be caught during a breach investigation or audit. The cost of a breach—notification, credit monitoring, legal fees—far exceeds the cost of doing it right from the start.

Basic PCI steps for any business: use HTTPS on all pages, keep your software and operating system patched, use strong passwords, enable two-factor authentication on admin accounts, and never store full card numbers, expiration dates, or CVV codes. If you need to store card data, use tokenization instead.

Handling fees and reconciliation

Payment gateways charge in three ways: a percentage of each transaction (usually 2.2 to 3.5 percent), a flat per-transaction fee (typically 20 to 30 cents), or a monthly subscription. Some charge all three. Hosted gateways tend to be simpler and more expensive; self-hosted gateways are cheaper but require more setup.

Your merchant account also charges fees—interchange fees (set by card networks), assessment fees, and sometimes monthly minimums. These vary by card type (debit vs. credit, domestic vs. international) and your industry. Ask your processor for a detailed fee schedule before you commit.

Reconciliation means matching the transactions in your gateway with the deposits in your bank account. Most gateways provide a settlement report showing which transactions were batched and when they hit your account. Deposits usually arrive one to three business days after the transaction, but some processors hold funds for seven to ten days on new accounts.

Set up automated reconciliation in your accounting software if possible. Stripe, Square, and most modern gateways integrate with QuickBooks, Xero, and Wave. This prevents duplicate entries and catches errors quickly.

Troubleshooting common implementation problems

The most common issue is a mismatch between test and live credentials. A developer builds the checkout in sandbox, then forgets to swap the API keys before going live. The result is transactions that appear to succeed but never actually charge. Check your live merchant account to confirm transactions are appearing there, not just in your system logs.

Another frequent problem is SSL certificate errors. If your checkout page is not HTTPS, browsers will block the payment form or show a security warning. Renew your certificate before it expires, and test the checkout page in an incognito window to confirm the padlock appears.

Declined transactions that should succeed usually mean the gateway is rejecting the card for a reason your system did not communicate clearly. Check the gateway's response code—each decline has a code (like "insufficient funds" or "lost card") that tells you why. Display this information to the customer so they can fix the problem.

If transactions are slow or timing out, check your gateway's status page and your own server logs. Timeouts can happen if your server is overloaded, your internet connection is unstable, or the gateway is experiencing an outage. Build retry logic into your checkout so a timeout does not automatically fail the transaction.

Frequently Asked Questions

Do I need a separate merchant account if I use Stripe or Square?

No. Stripe and Square issue merchant accounts as part of their service. You sign up, provide business information, and they handle the banking relationship. Other gateways like Authorize.Net require you to open a merchant account separately through a bank or processor.

How long does it take to go live after I start integration?

For a straightforward Shopify store with a plugin, a few hours. For a custom website with API integration, one to four weeks depending on your developer's experience and how much custom checkout logic you need. Merchant account approval adds five to ten business days on top of that.

What test card numbers should I use in sandbox?

Most gateways provide a list in their documentation. Common ones are 4111111111111111 for a successful charge, 4000000000000002 for a decline, and 4000002500003155 for a 3D find authentication test. Use any future expiration date and any three-digit CVV.

Can I switch gateways after I go live?

Yes, but it requires planning. You will need to migrate your stored payment tokens (if you have any) to the new gateway, update your checkout code, and test thoroughly. Existing subscriptions or recurring charges may need to be re-authorized. Plan for a few hours of downtime or run both gateways in parallel during the transition.

What happens if a customer disputes a charge?

The customer contacts their bank, which contacts your processor. You receive a chargeback notice and have a window (usually 7 to 10 days) to respond with evidence—the order confirmation, shipping proof, or a signed receipt. If you lose the dispute, the charge is reversed and you pay a chargeback fee (typically $15 to $100). Keep detailed records of every transaction to defend yourself.