A payment gateway is the technology that captures a customer’s payment details at checkout, encrypts them, and transmits them securely to the systems that authorize and process the transaction. It is the entry point for nearly every card and digital payment a business accepts, the component that stands between the moment a customer clicks “pay” and the moment their bank approves or declines the charge.
Almost every online business relies on one, yet the gateway is one of the most misunderstood pieces of the payment stack, routinely confused with payment processors, acquirers, and payment service providers. Getting the distinctions right matters, because the gateway’s capabilities shape checkout conversion, security obligations, the payment methods a business can offer, and how well payments scale as the business grows. What follows is a plain explanation of what a payment gateway is, how it works step by step, the types available, the security standards involved, and how to evaluate one.
Payment gateway, defined
A payment gateway is a software service that securely collects a customer’s payment information and transmits it between the customer, the merchant, and the financial institutions that approve and settle the payment. It performs three core jobs: it captures the payment data at the point of checkout, it encrypts that data so it can travel safely, and it relays the authorization request and response between the merchant and the wider payment system.
The gateway does not itself move money. It moves information. The actual transfer of funds is handled by processors, acquirers, and banks further down the chain. The gateway’s role is to be the secure conduit that carries the payment request into that system and carries the approve-or-decline answer back out. This distinction (information versus funds) is the single most useful thing to understand about a gateway, because it explains why a gateway alone is not enough to accept a payment and why it always works alongside other components.
Gateways handle payments across channels: online checkouts, in-app purchases, and in-person point-of-sale terminals all rely on a gateway to capture and transmit payment data. For card-not-present transactions in particular (online and in-app), the gateway is essential, because there is no physical card or terminal to secure the data at the point of sale.
How a payment gateway works, step by step
The gateway’s role is easiest to understand by following a single card transaction from checkout to approval. A typical online card payment moves through the following sequence, all of which happens in a few seconds.
1. The customer enters payment details. At checkout, the customer provides their card number, expiry, and security code, or authorizes a stored card or digital wallet. This happens on the merchant’s site, in an app, or on a page hosted by the gateway.
2. The gateway encrypts the data. The gateway secures the sensitive payment information using encryption protocols (TLS in transit) so that the card data cannot be read as it travels. In modern implementations, the data is also often tokenized, replacing the card number with a token so the raw number is never exposed to the merchant’s systems.
3. The gateway transmits the authorization request. The encrypted, tokenized transaction is passed to the payment processor, which formats it and forwards an authorization request through the appropriate card network (Visa, Mastercard, and others).
4. The card network routes to the issuing bank. The network passes the request to the customer’s issuing bank, which checks that the card is valid, that sufficient funds or credit are available, and that the transaction does not trip fraud or risk rules. Where regulations require it, strong customer authentication (such as 3D Secure) is applied at this stage.
5. The issuing bank approves or declines. The bank returns an authorization response (approved or declined, with a reason code if declined) back through the card network to the processor.
6. The gateway relays the response. The processor passes the response back to the gateway, which communicates the result to the merchant and the customer. If approved, the order proceeds; if declined, the customer is prompted accordingly.
7. Settlement follows later. Approval places a hold on the funds, but the actual movement of money happens during settlement, typically in batches at the end of the day. The issuing bank transfers the funds, which arrive in the merchant’s account after the acquirer processes the settlement, usually within a couple of business days.
The important nuance most explanations blur is that authorization and settlement are two separate events. The gateway’s most visible work happens during authorization (the real-time approve-or-decline in steps 1 through 6). Settlement, the actual transfer of funds, happens afterward and involves the acquirer and the banks more than the gateway.
Payment gateway versus processor, acquirer, and PSP
The gateway is one of several components in the payment stack, and it is constantly confused with the others. A clean disambiguation:
- Payment gateway: captures and transmits payment data securely between the merchant and the processing system. It handles the information.
- Payment processor: takes the transaction from the gateway, formats it, and moves the authorization request through the card networks to the banks, then handles the mechanics of settlement. It handles the transaction mechanics and the money movement.
- Acquiring bank (acquirer): the merchant’s bank, which holds the merchant account, receives the settled funds, and carries the financial relationship with the card networks on the merchant’s behalf.
- Payment service provider (PSP): a company that bundles several of these functions together, often providing the gateway, processing, and acquiring relationship in a single package so a merchant does not have to assemble them separately.
A helpful way to hold the distinction: the gateway is the front door where the payment request enters, the processor is the courier that carries the request through the network and moves the funds, and the acquirer is the merchant’s bank that receives the money at the end of the flow. Many modern providers combine these roles, which is why the terms get used loosely, but they remain distinct functions.
For a deeper treatment of how these roles interact and where a payment orchestration layer fits above them, see Gr4vy’s guide on payment orchestration vs payment gateway vs payment processor, the breakdown of what a PSP does, and the comparison of card networks versus payment processors.
The main types of payment gateway
Gateways differ mainly in where the payment data is captured and how much of the checkout the merchant controls. Three models dominate.
Hosted (redirect) gateways
The customer is redirected from the merchant’s site to a payment page hosted by the gateway provider, completes payment there, and returns to the merchant’s site afterward. The merchant never handles card data, which keeps its security and compliance burden low. The trade is less control over the checkout experience and a redirect that can introduce friction. Hosted gateways suit businesses that want the simplest, lowest-compliance route to accepting payments.
Self-hosted / API gateways
The merchant captures payment data directly in its own checkout and passes it to the gateway through an API. This gives the merchant full control over the checkout experience and branding, at the cost of a significantly higher security and compliance burden, because card data flows through the merchant’s environment. This model suits businesses with the engineering resources and compliance maturity to manage it.
Hosted fields (the middle ground)
Secure input fields served by the gateway are embedded directly inside the merchant’s own checkout page, so the customer stays on the merchant’s site while the sensitive card data is captured inside the gateway’s isolated fields. This combines much of the control of the API model with much of the reduced compliance burden of the hosted model, which is why it has become the common choice for many enterprise checkouts.
The choice between these models is a meaningful decision in its own right, with implications for conversion, PCI compliance scope, and engineering effort. Gr4vy’s guide on hosted checkout versus API checkout works through the tradeoffs in detail.
Security and compliance: what a gateway must handle
Because a payment gateway handles sensitive card data, security is central to what it does, and it operates under specific standards.
PCI DSS compliance. Any system that touches cardholder data must comply with the Payment Card Industry Data Security Standard. The current version, PCI DSS 4.0.1, tightened requirements around stored data, script integrity, and authentication. A gateway’s design has a direct effect on how much of the PCI burden falls on the merchant: hosted and hosted-fields models can substantially reduce the merchant’s compliance scope, while a full API integration expands it.
Encryption. Gateways encrypt payment data in transit (and often at rest) so that card details cannot be intercepted and read as they move between the customer, the gateway, and the processor.
Tokenization. Modern gateways commonly replace the card number with a token, so the actual number is never stored in or exposed to the merchant’s systems. Network tokenization goes a step further by using a network-issued token that updates automatically when the underlying card is reissued, which improves both security and authorization rates. Gr4vy’s guide on how network tokenization works covers the mechanism.
Authentication. For card-not-present transactions in regulated markets, gateways support 3D Secure and the strong customer authentication that regulations such as PSD2 require. Gr4vy’s guide on implementing 3D Secure explains how this layer works.
For the specific interaction between compliance and a broader orchestrated payment stack, see Gr4vy’s analysis of PCI DSS compliance and payment orchestration.
What a payment gateway affects in a business
The gateway does more than pass data along. Its capabilities influence several things that matter directly to revenue and operations.
Checkout conversion. A slow, clunky, or redirect-heavy gateway experience causes cart abandonment. A smooth, fast, well-integrated gateway keeps customers moving through checkout.
Authorization rates. How a gateway handles tokenization, retries, and the data it passes to issuers affects how many transactions get approved. Small differences in approval rates compound into meaningful revenue over time.
Payment method coverage. The gateway determines which payment methods a business can offer. A gateway limited to a narrow set of card types constrains the business; one that supports cards, wallets, and local methods opens up more customers.
Security and compliance load. The gateway model chosen determines how much PCI compliance burden the merchant carries, which has real cost and operational consequences.
Cost. Gateway pricing (per-transaction fees, monthly fees, setup costs) feeds directly into the cost of accepting payments, and the true cost includes chargeback handling and any fees buried in the fee schedule.
How to choose a payment gateway
The right gateway depends on the business, but a consistent set of criteria applies to the evaluation.
Security and compliance. Confirm PCI DSS compliance, strong encryption, tokenization support, and fraud tooling. The gateway’s model also determines how much compliance scope lands on the business, so weigh that against the engineering resources available.
Payment method and market coverage. Check that the gateway supports the card types, digital wallets, and local payment methods relevant to the markets the business sells into. Cross-border sellers should confirm multi-currency support.
Total cost across the full schedule. Look past the advertised per-transaction rate to setup fees, monthly fees, chargeback fees, and any line items in the full fee schedule. Ask for the complete schedule and question anything unclear before committing.
Integration and developer experience. The gateway has to fit the existing tech stack. Poor integration creates operational friction and slows the business down. Evaluate the quality of the APIs, SDKs, and documentation.
Checkout experience. Because the gateway shapes the checkout, evaluate how the payment experience feels across devices, how many steps it imposes, and whether it supports the branding and flow the business wants.
Reliability and redundancy. A gateway that goes down takes checkout down with it. Consider uptime, and consider whether relying on a single gateway is a risk the business can afford, or whether connecting to more than one through an orchestration layer is warranted.
That last point is where many growing businesses eventually run into the limits of a single gateway. Relying on one gateway means one point of failure, one set of authorization performance characteristics, and one commercial relationship. As payment volume and complexity grow, businesses often move to connect several gateways and route transactions across them, which is the role a payment orchestration layer plays above the individual gateways.
Frequently asked questions
What is a payment gateway in simple terms?
A payment gateway is the technology that securely captures a customer’s payment details at checkout and transmits them to the systems that approve the payment. It works like a secure front door for payment information: it takes the card details, encrypts them, sends them off for approval, and brings back the approve-or-decline answer. It handles payment information rather than moving the money itself.
What is the difference between a payment gateway and a payment processor?
A payment gateway captures and securely transmits payment data between the merchant and the processing system. A payment processor takes that transaction, moves the authorization request through the card networks to the banks, and handles the mechanics of settling the funds. The gateway handles the information; the processor handles the transaction mechanics and the money movement. Many providers offer both, which is why the terms are often confused.
Does a payment gateway move the money?
No. The gateway moves payment information rather than funds. It captures and transmits the payment data and relays the approval or decline. The actual movement of money happens during settlement and is handled by the processor, the acquiring bank, and the issuing bank. This is why a gateway alone cannot complete a payment and always works alongside these other components.
Do I need a payment gateway to accept online payments?
For card-not-present transactions such as online and in-app payments, yes, in practice. There is no physical card or terminal to capture and secure the payment data, so a gateway is needed to capture, encrypt, and transmit it. Businesses accept card payments online through a gateway, whether standalone or bundled inside a payment service provider.
How much does a payment gateway cost?
Pricing varies widely and typically includes per-transaction fees, and sometimes monthly fees, setup fees, and chargeback fees. The important step is to look past the headline per-transaction rate to the complete fee schedule, including any charges for chargebacks, refunds, or cross-border transactions, and to question any line item that is unclear before signing.
What are the types of payment gateways?
The three main models are hosted (redirect) gateways, where the customer is sent to the gateway’s payment page; self-hosted or API gateways, where the merchant captures data in its own checkout and passes it through an API; and hosted fields, where the gateway’s secure input fields are embedded inside the merchant’s own checkout page. They differ mainly in how much control the merchant has over the checkout and how much security and compliance burden it carries.
Is a payment gateway the same as a merchant account?
No. A payment gateway is the technology that transmits payment data. A merchant account is a type of bank account, held with an acquiring bank, into which settled funds are deposited. A business generally needs both: the gateway to capture and transmit the payment, and a merchant account to receive the money. Some providers bundle the two together.
How does a payment gateway keep transactions secure?
Gateways secure transactions through encryption of payment data in transit, tokenization that replaces the card number so it is never exposed, PCI DSS compliance covering how cardholder data is handled, and support for authentication measures such as 3D Secure for card-not-present transactions in regulated markets. Together these protect the sensitive data as it moves through the payment flow.
Can a business use more than one payment gateway?
Yes, and many growing businesses do. Using more than one gateway provides redundancy (so checkout does not fail if one gateway goes down), lets the business route transactions to whichever gateway performs best for a given card or market, and avoids dependence on a single commercial relationship. Connecting and routing across multiple gateways is the role a payment orchestration layer performs above the individual gateways.
What is the difference between a payment gateway and a payment service provider?
A payment gateway is one specific component (the technology that captures and transmits payment data). A payment service provider (PSP) is a company that bundles several payment functions together, often including the gateway, the processing, and the acquiring relationship, so a merchant can accept payments through a single provider rather than assembling the pieces separately. A PSP typically includes a gateway as part of what it offers.
What should I look for when choosing a payment gateway?
Evaluate security and PCI compliance, the payment methods and markets it supports, the total cost across the full fee schedule rather than just the headline rate, the quality of its integration and documentation, the checkout experience it produces, and its reliability. For businesses expecting to grow, it is also worth considering whether a single gateway will remain sufficient or whether routing across multiple gateways will eventually be needed.
The bottom line on gateways
A payment gateway is the component that gets a payment request safely from the customer’s checkout into the system that approves it, and carries the answer back. It handles information rather than money, works alongside processors and acquirers rather than replacing them, and comes in models that trade control against compliance burden. For a single-market business accepting card payments, a well-chosen gateway is often all that is needed at the start.
The limits show up with growth. A single gateway is a single point of failure, a single set of authorization characteristics, and a single commercial relationship, and as volume, markets, and payment methods multiply, businesses tend to want more than one gateway working for them. That is the point at which the conversation moves from choosing a gateway to coordinating several, which is what a payment orchestration platform is built to do: connect many gateways and providers through one integration and route each transaction to the one most likely to serve it best.
Gr4vy is a cloud-native payment orchestration platform that connects merchants to more than 400 payment providers and methods through a single integration, sitting above individual gateways to route, optimize, and add redundancy across all of them. To understand how a gateway fits into a broader payment strategy for your business, talk to our team.
