What a payment gateway does

A payment gateway is the software that captures payment information from a customer, encrypts it, and sends it to the bank or payment processor for approval. It is the digital equivalent of the card reader at a checkout counter — it takes the card details or bank account information, verifies it is real, and tells you whether the transaction went through or failed.

The gateway does not hold money or move it between accounts. It is a messenger and a security checkpoint. When a customer enters their card number on your website or in your app, the gateway receives that information, protects it from being read in transit, and passes it along to the payment processor, which then contacts the customer's bank to confirm the funds exist and the cardholder approves the charge.

The entire process typically takes two to five seconds from the moment a customer clicks "pay" to the moment they see a confirmation or error message on their screen.

Key Takeaways

  • A payment gateway encrypts and transmits payment information from your customer to their bank, but does not move money itself.
  • The gateway sits between your website or app and the payment processor, handling the technical handoff that makes the transaction possible.
  • Common gateways include Stripe, Square, PayPal, and Authorize.net, each with different fee structures and features.
  • The gateway must be PCI-compliant, meaning it meets security standards set by the card networks to protect customer data.
  • You need a gateway to accept card payments online; without one, you cannot securely receive or process card information.

How the gateway fits into the payment flow

The payment gateway is one piece of a larger chain. When a customer makes a purchase, the flow looks like this: customer enters payment details into your website → gateway receives and encrypts the data → gateway sends it to the payment processor → processor contacts the customer's bank → bank approves or declines → processor sends the result back to the gateway → gateway displays the result to your customer.

You interact with the gateway; the gateway interacts with the processor; the processor interacts with the banks. The gateway is your direct connection to the payment system. If the gateway is down, your customers cannot pay you, even if the banks and processors are working fine.

Different gateways connect to different processors and banks, which is why some gateways work better in certain countries or for certain types of transactions. A gateway that works well for U.S. credit cards may not support Chinese mobile wallets, for example.

What information the gateway handles

The gateway receives and encrypts several pieces of information: the card number, expiration date, and CVV (the three-digit security code on the back); the cardholder's name and billing address; and sometimes the customer's email and phone number. It may also receive the transaction amount, a description of what is being purchased, and an order ID from your system.

The gateway does not store most of this information. It receives it, encrypts it when ready, sends it to the processor, and then deletes it from its own servers — or, in some cases, stores it only if you have asked it to (for example, to enable one-click checkout on repeat customers). This is why you cannot retrieve a customer's full card number from a gateway after the transaction is complete; the gateway was designed not to keep it.

The one piece of information the gateway typically does store is the last four digits of the card and a token — a unique identifier that represents that card without exposing the actual number. This token allows you to charge the same customer again without asking for their card details a second time.

Hosted versus integrated gateways

A hosted gateway redirects your customer to a page controlled by the gateway provider. Your customer enters their payment details on that external page, not on your website. Examples include PayPal's checkout and Square's hosted payment page. The advantage is that you never see or handle the customer's card information directly, which reduces your security responsibility. The disadvantage is that the customer leaves your website, which can feel less seamless.

An integrated gateway (also called an embedded gateway) lets the customer enter their payment details directly on your website or app. Stripe and Authorize.net are common choices for this approach. The payment form looks like part of your site, but the gateway handles the encryption behind the scenes. This feels more seamless to the customer but requires you to meet higher security standards because the payment information passes through your servers, even though it is encrypted.

A third option is a mobile wallet gateway, which processes payments from Apple Pay, Google Pay, or similar services. The customer authorizes the payment on their phone, and the gateway receives a token representing that authorization rather than the card details themselves.

Common gateways and how they differ

Stripe is an integrated gateway popular with online businesses and software companies. It charges a percentage of each transaction (typically 2.9% plus $0.30 for U.S. credit cards) and requires you to meet PCI compliance standards. Stripe provides detailed documentation and webhooks that let your system know when a payment succeeds or fails.

Square offers both hosted and integrated options and is common among small businesses and in-person retailers. Square's online gateway charges similar percentages to Stripe. Square also owns the hardware readers used at physical checkout counters, so it is a full payment ecosystem if you sell both online and in person.

PayPal operates a hosted gateway where customers are redirected to PayPal's site to complete payment. PayPal charges a percentage per transaction and does not require you to handle card information directly. Many customers already have PayPal accounts, which can reduce friction.

Authorize.net is an older, integrated gateway used by many established businesses. It charges a monthly gateway fee (typically $25 to $35) plus a per-transaction fee, which can be cheaper than percentage-based pricing if you process high volumes.

PCI compliance and why it matters

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements that any business handling card information must follow. The standard covers how you store data, who can access it, how you encrypt it, and how you monitor for breaches. It exists to protect customers from fraud and theft.

If you use a hosted gateway like PayPal, you have minimal PCI responsibility because the customer's card information never touches your servers. If you use an integrated gateway, you have more responsibility, even though the gateway encrypts the data. You must may support your website uses HTTPS (a find connection), that your servers are not storing unencrypted card numbers, and that you are monitoring for unauthorized access.

Failing to meet PCI standards can result in fines from the card networks (Visa, Mastercard, American Express) and can make you liable if customer data is stolen. Most gateways handle the technical encryption for you, but you are still responsible for the overall security of your system.

Fees and what they cover

Payment gateways charge in different ways. Most online gateways charge a percentage of each transaction (usually 2.5% to 3.5% for credit cards) plus a fixed fee per transaction (usually $0.20 to $0.50). Some charge a monthly gateway fee instead of or in addition to per-transaction fees. A few charge a flat monthly fee with no per-transaction cost.

The fee covers the gateway's infrastructure, security, customer support, and the cost of connecting to payment processors and banks. Higher fees sometimes come with more features — better reporting tools, faster payouts, support for more payment methods, or access to advanced features like recurring billing or fraud detection.

You should compare gateways based on your expected transaction volume and the payment methods your customers will use. A gateway that charges 2.9% plus $0.30 per transaction costs you $2.99 on a $100 sale, while one charging $35 per month plus $0.10 per transaction costs you $35.10 on 100 sales of $100 each. The math changes depending on your volume.

Frequently Asked Questions

Do I need a separate payment gateway if I use Shopify or WooCommerce?

Shopify and WooCommerce have built-in gateways, but you can also connect external ones. Shopify's built-in gateway (Shopify Payments) is integrated into the platform. WooCommerce requires you to install a gateway plugin. Many businesses use the platform's default gateway because it is simpler, but you can switch to Stripe, Square, or others if you want different features or pricing.

What happens if the gateway goes down?

If the gateway is unavailable, customers cannot complete payments on your website. Your site may still load, but the payment form will not work or will show an error. This is why many businesses monitor their gateway's status page and have a backup gateway configured. Some gateways offer redundancy by connecting to multiple processors so that if one path fails, payment can still go through.

Can a payment gateway store my customer's card information?

Yes, but only with explicit permission and only if you meet PCI compliance standards. Most gateways offer tokenization, which stores a token representing the card rather than the card number itself. This lets you charge returning customers without asking for their card details again. You must disclose this in your privacy policy and give customers the option to opt out.

Why do some gateways take longer to deposit money into my account?

Gateways vary in how quickly they move money from the customer's bank to your business account. Some deposit funds the next business day; others take two to five business days. Newer businesses or those in high-risk industries (like gambling or adult services) often face longer hold periods. The gateway's terms will specify the deposit timeline.

Can I use multiple payment gateways at the same time?

Yes. Many businesses use one gateway for credit cards and another for digital wallets, or use a backup gateway in case the primary one fails. Your website or app can be configured to offer multiple payment options, each routed to a different gateway. This adds complexity but gives you flexibility and redundancy.