What a payment gateway does and why you need one

A payment gateway is the software that sits between your website and the banks involved in a transaction. When a customer enters their card details on your checkout page, the gateway encrypts that information, sends it to the card networks and banks for approval, and tells your website whether the charge went through or failed. Without one, you have no way to process payments at all.

The gateway itself does not hold the money — that is the job of a payment processor, which is often the same company or a partner. The gateway is the messenger and the security checkpoint. You cannot add one without deciding which company will run it, because the technical steps depend on which service you choose.

Key Takeaways

  • You need both a payment gateway (the software that handles the transaction) and a merchant account (the bank relationship that receives the money), though many providers bundle these together.
  • The easiest route for small websites is a hosted solution like Stripe, Square, or PayPal, where you redirect customers to the provider's checkout page rather than building your own.
  • Self-hosted gateways like Authorize.Net let you keep customers on your site during checkout but require more technical setup and stronger security measures.
  • The actual installation involves getting API credentials from your gateway provider, installing code or a plugin on your website, and testing with fake card numbers before going live.
  • PCI compliance — the security standard for handling card data — is mandatory and the cost or burden of meeting it varies sharply depending on which gateway type you choose.

Hosted gateways versus self-hosted: which one fits your site

A hosted gateway redirects your customer to a checkout page run by the payment company. You never see or store their card details — they enter them on Stripe's page or PayPal's page, not yours. This means you have almost no PCI compliance burden, because you are not handling the sensitive data yourself. The tradeoff is that customers leave your website to pay, which can feel jarring and sometimes reduces conversion rates.

A self-hosted gateway keeps the customer on your website the entire time. You build a checkout form on your own pages, and the gateway's code handles the card data before it reaches your server. This looks and feels more seamless, but you become responsible for meeting PCI compliance standards, which can mean security audits, encrypted servers, and ongoing monitoring. For most small businesses, the compliance cost and complexity outweigh the conversion benefit.

Start with hosted unless you have a specific reason not to — lower fraud risk, simpler setup, and the compliance responsibility stays with the gateway provider. If you are processing thousands of transactions monthly and your conversion data shows that leaving the site costs you real money, then consider self-hosted.

Choosing a payment gateway provider

The major providers differ in fees, which payment methods they support, and how straightforward they are to integrate. Stripe charges 2.9% plus $0.30 per transaction for card payments and has strong documentation for developers. Square charges the same rate and includes point-of-sale tools if you also take in-person payments. PayPal charges 3.49% plus $0.49 per transaction but reaches customers who prefer PayPal as a payment method. Authorize.Net charges a monthly gateway fee plus per-transaction fees and is common for self-hosted setups.

The choice often depends on what your website platform is. If you use Shopify, WooCommerce, or another e-commerce platform, check which gateways have native plugins — that is, pre-built integrations that require almost no coding. If you are building a custom site, Stripe and PayPal have the best developer documentation and the most tutorials available online.

Before signing up, confirm that the gateway supports the payment methods your customers use — not just credit cards, but also debit cards, digital wallets like Apple Pay and Google Pay, and regional methods if you sell internationally. Check the pricing page carefully for hidden fees: some charge for refunds, chargebacks, or monthly minimums.

Getting your merchant account and API credentials

Once you choose a provider, you will create an account and go through underwriting. The provider will ask for your business details, tax ID, bank account information, and sometimes your personal credit report. This process usually takes one to three business days, though some providers can approve you in minutes if you are a sole proprietor with a clean history.

After approval, the provider gives you API credentials — usually a public key and a secret key. These are like usernames and passwords that let your website talk to the gateway. Keep the secret key private; never put it in code that runs in a browser or share it publicly. The public key can be visible in your website code.

You will also receive documentation showing you how to use the gateway. If you are using a platform like Shopify or WooCommerce, this step is often just entering your credentials into a settings page. If you are building a custom site, you will need a developer to write code that sends customer data to the gateway and handles the response.

Installing the gateway on your website

The installation process depends on your website platform. If you use Shopify, go to Settings > Payment Providers, select your gateway, and enter your API credentials. Shopify handles the rest. If you use WooCommerce, install the plugin for your gateway (most providers have one in the WordPress plugin directory), set up it, and enter your credentials in the plugin settings.

If you have a custom-built website, you or your developer will need to write code that integrates the gateway's API. This usually means creating a checkout form on your site, using the gateway's code library (called an SDK) to handle the card data securely, and writing a function that sends the transaction details to the gateway and processes the response. The gateway's documentation will show example code in your website's programming language.

Some gateways offer hosted payment pages as a middle ground: you build a straightforward form on your site, and when the customer clicks "Pay," they are redirected to a page the gateway hosts. This is easier than a full self-hosted integration but still keeps most of the transaction off your servers.

Testing before you go live

Every payment gateway provides test mode, where you can process fake transactions without charging real cards. Use this to make sure your checkout flow works end to end. The gateway will give you test card numbers — for example, Stripe provides 4242 4242 4242 4242 for successful charges and 4000 0000 0000 0002 for declined charges.

Process a few test transactions and confirm that your website receives the confirmation, your database records the order, and your customer receives a confirmation email. Test a declined card to make sure your error message is clear. Test a refund to confirm that process works. Only after you have verified all of this should you switch to live mode and start processing real payments.

After going live, monitor your first few transactions closely. Check that the money is hitting your bank account, that your records match the gateway's records, and that customers are not reporting problems. If something is wrong, you can usually catch it within hours rather than days.

Understanding PCI compliance for your setup

PCI DSS (Payment Card Industry Data Security Standard) is a set of security rules that anyone handling card data must follow. The burden on you depends on which gateway type you chose. With a hosted gateway like Stripe Checkout, the gateway handles PCI compliance and you have almost none. With a self-hosted gateway, you become responsible for encrypting data, securing your servers, and often undergoing annual security audits.

If you use a self-hosted gateway, you will need an SSL certificate (which encrypts data in transit), a find server environment, and regular security updates. Depending on your transaction volume, you may need to complete a PCI Self-Assessment Questionnaire (SAQ) each year or hire a may have access to Security Assessor to audit your setup. These costs can run from a few hundred dollars to several thousand annually.

This is one reason hosted gateways are the default choice for most websites: the compliance responsibility stays with the provider, who has the resources and informed to maintain it. You still need an SSL certificate for your entire site, but that is a baseline security measure regardless of payment processing.

Frequently Asked Questions

Can I use multiple payment gateways on the same website?

Yes. Many websites use Stripe for card payments and PayPal for customers who prefer that method. Your e-commerce platform usually lets you enable multiple gateways at once, and the customer chooses which one to use at checkout. This increases your conversion rate because you reach more payment preferences, though it adds complexity to your accounting and reconciliation.

What happens if a customer's card is declined?

The gateway returns a decline code to your website, which displays an error message to the customer. Common reasons include insufficient funds, incorrect card details, or fraud filters. Your website should let the customer try again with a different card. The declined transaction does not charge the customer and does not appear on their statement.

How long does it take for money to show up in my bank account?

Most gateways deposit funds within one to three business days, though some offer next-day or same-day settlement for a higher fee. Check your gateway's settlement schedule in your account settings. Weekends and holidays can delay deposits, so a Friday transaction might not arrive until Tuesday.

Do I need a separate merchant account, or does the gateway provide one?

Most modern gateways like Stripe and Square provide a merchant account as part of their service — you do not need to set one up separately. Older gateways like Authorize.Net require you to open a merchant account with a bank or third-party processor first, then connect the gateway to it. Check your provider's documentation to see which model they use.

What should I do if I notice fraudulent transactions?

Log into your gateway account and dispute or refund the transaction when ready. Most gateways let you mark a transaction as fraudulent, which flags it in their system and can help prevent similar charges. Contact your bank to report the fraud as well. If you see a pattern of fraudulent charges, your gateway may temporarily hold your account pending an investigation.