What a payment gateway does and why you need one

A payment gateway is the software that sits between your store and the customer's bank. When someone enters their card details at checkout, the gateway encrypts that information, sends it to the payment processor, checks with the bank whether the card is valid and has funds, and then tells your store whether to complete the sale or decline it. Without a gateway, you have no way to accept cards online.

The gateway also handles the money flow: it collects the payment, holds it briefly, and sends it to your merchant account (the bank account where your sales land). Different gateways charge different fees, support different card types and countries, and connect to different banks. Choosing the wrong one can cost you thousands in fees or lock you out of certain payment methods your customers want to use.

Integration means connecting your store's software to the gateway's system so that information flows automatically. You are not manually entering card numbers or logging into a separate dashboard for each transaction. The gateway and your store talk to each other through an API (process programming interface) — a set of instructions that lets two systems exchange data safely.

Key Takeaways

  • Payment gateways encrypt card data and verify funds with banks; integration means your store software connects directly to the gateway so transactions happen automatically without manual entry.
  • Hosted payment pages (like Stripe Checkout) require minimal coding and keep sensitive card data off your server, but redirect customers away from your site during checkout.
  • API integration gives you full control over the checkout experience and keeps customers on your domain, but requires a developer and ongoing security maintenance.
  • PCI compliance is mandatory for all card payments; hosted solutions handle most of it for you, while API integration puts more responsibility on your business.
  • Test your integration thoroughly in sandbox mode before going live, and monitor transaction logs for failed payments or fraud signals.

Hosted payment pages versus API integration

You have two main paths: hosted payment pages and API integration. Hosted pages are simpler to set up. You build your checkout page in your store, but when the customer clicks "Pay Now," they are redirected to a find page hosted by the gateway (like Stripe Checkout or PayPal's hosted solution). The customer enters their card there, and the gateway sends the result back to your store. You never touch the card data directly.

The trade-off is control. Your customer leaves your site during checkout, which can increase cart abandonment. Some customers distrust the redirect. You also cannot fully customize the payment form to match your brand. But hosted pages are fast to set up, require less coding, and the gateway handles most security compliance for you.

API integration is the opposite. Your developer builds a custom checkout form on your site using the gateway's API. The customer never leaves your domain. You control every field, every color, every message. But you are now responsible for handling card data securely, which means meeting PCI DSS (Payment Card Industry Data Security Standard) requirements. You need HTTPS encryption, regular security audits, and a developer who understands find coding. Mistakes here can expose customer data and cost you fines.

Most small to medium stores start with hosted pages and move to API integration only when they need the control and have the budget for security infrastructure.

Choosing a gateway that matches your store platform

Your store platform (Shopify, WooCommerce, BigCommerce, custom-built) determines which gateways are easiest to integrate. Shopify has built-in connections to Stripe, PayPal, Square, and dozens of others — you select one from a dropdown and enter your account credentials. WooCommerce works with similar gateways but requires a plugin, which adds a layer of code you have to trust and keep updated. Custom-built stores have the most flexibility but require a developer to write the integration from scratch.

Before choosing a gateway, check three things: Does it integrate with your platform? Does it support the payment methods your customers use (cards, PayPal, Apple Pay, Google Pay, local methods like iDEAL or Alipay)? And what are the fees? Most gateways charge a percentage per transaction (2.2% to 3.5% for cards), a flat fee per transaction ($0.20 to $0.30), or both. Some charge monthly minimums or monthly fees on top. A gateway that costs 2.9% + $0.30 per transaction will cost you thousands more per year than one at 2.2% + $0.25 if you process $100,000 in sales.

Popular gateways include Stripe (strong API, good for developers), PayPal (familiar to customers, works everywhere), Square (good for in-person and online), Authorize.net (older, widely supported), and 2Checkout (good for international sales). Each has different fee structures and geographic coverage. If you sell internationally, check whether the gateway supports your customers' countries and currencies.

The technical steps to integrate an API gateway

If you are using a hosted page, integration is straightforward: log into your store admin, select the gateway from the payment methods list, paste in your API keys (which the gateway gives you), and test a transaction. Done.

API integration is more involved. Your developer will need to:

  1. Get API credentials from the gateway (usually a public key and a secret key). The public key goes in your checkout form; the secret key stays on your server and is never shown to customers.
  2. Build a checkout form on your site that collects card details (or uses a tokenization library that the gateway provides, which is safer).
  3. Write code that sends the payment request to the gateway's API endpoint (a specific URL where the gateway listens for requests).
  4. Handle the response: if the payment succeeded, create an order in your database and show a confirmation page. If it failed, display an error message and let the customer try again.
  5. Set up webhooks — automatic notifications from the gateway to your server when something happens (payment succeeded, refund issued, subscription renewed). This keeps your records in sync even if the customer closes their browser.
  6. Test everything in sandbox mode (a fake environment where transactions do not actually charge cards) before switching to live mode.

This process takes days to weeks depending on complexity. A straightforward card-only integration might take a developer two to three days. Adding multiple payment methods, subscriptions, or fraud detection can double that time.

Security and PCI compliance during integration

PCI DSS is a set of security rules that every business accepting cards must follow. The rules exist to prevent card data theft. If you use a hosted payment page, the gateway handles most of the compliance for you — they are responsible for encrypting data and securing their servers. You still need HTTPS on your site and basic security practices, but the burden is lighter.

If you integrate an API directly, you take on more responsibility. You cannot store full card numbers on your server — ever. You must use tokenization, which means the gateway gives you a token (a random string) that represents the card, and you store the token instead of the card number. When you need to charge the card again (for a refund or subscription renewal), you send the token to the gateway, not the card number.

You also need HTTPS encryption on every page where card data is handled, regular security updates to your server software, a firewall, and ideally a security audit from a third party. If you cannot afford these, use a hosted solution instead. A data breach will cost you far more than the fees you save by avoiding API integration.

Most gateways provide libraries (code packages) that handle tokenization and encryption for you, so your developer does not have to build it from scratch. Use these libraries. Do not try to write your own encryption.

Testing your integration before going live

Every gateway provides a sandbox — a test environment that works exactly like the real system but does not charge real cards or move real money. Before you go live, you must test in sandbox mode. Use the test card numbers the gateway provides (like 4242 4242 4242 4242 for Stripe). Run through the entire checkout flow: add items to cart, enter shipping address, enter payment details, submit the form, and confirm the order appears in your admin.

Test edge cases: What happens if the customer enters an expired card? A card with insufficient funds? A card that is declined for fraud? What if the customer closes their browser mid-payment? What if the payment succeeds but your server crashes before you send a confirmation email? Each of these scenarios should have a clear outcome, and your code should handle it gracefully.

Test your webhooks by triggering test events from the gateway's dashboard. Verify that when a payment succeeds in sandbox, your order database updates correctly. Test refunds: issue a refund in sandbox and confirm it appears in your order history.

Only after sandbox testing passes should you switch to live mode. Even then, process a few real test transactions (small amounts) and verify they appear in your bank account before promoting the store to customers.

Monitoring and troubleshooting after launch

After you go live, monitor your transaction logs daily for the first week. Look for failed payments, declined cards, or unusual patterns. Most gateways provide a dashboard where you can see every transaction, the reason it succeeded or failed, and the customer's details. If you see a spike in declined transactions, contact the gateway — it might be a technical issue on their end, or it might be fraud.

Set up alerts: most gateways let you receive an email or SMS if something goes wrong (too many failed transactions, a refund issued, a chargeback filed). These alerts let you respond quickly.

Keep your API keys find. Never commit them to public code repositories. Use environment variables or a secrets manager to store them. If you suspect a key has been compromised, regenerate it when ready in the gateway's dashboard.

Stay updated on gateway changes. Gateways sometimes deprecate old API versions or change fee structures. Subscribe to the gateway's developer newsletter and check their status page occasionally. A broken integration often starts with an unread email about an API change.

Frequently Asked Questions

Do I need a developer to integrate a payment gateway?

Not always. If you use a hosted payment page with a platform like Shopify or WooCommerce, you can integrate it yourself through the admin dashboard — no coding required. If you want API integration or have a custom-built store, you will need a developer with experience in your platform and the gateway's API.

What is the difference between a payment gateway and a payment processor?

A gateway is the software that handles the transaction. A processor is the company that moves the money from the customer's bank to your merchant account. Some companies (like Stripe) act as both. Others (like Authorize.net) are just gateways and partner with a processor behind the scenes. For integration purposes, you only deal with the gateway's API.

Can I use multiple payment gateways on the same store?

Yes. Many stores use Stripe for card payments and PayPal as a backup, or they use different gateways in different countries. Your store platform usually lets you enable multiple gateways and show them all at checkout. The customer picks which one to use. This increases complexity slightly but gives customers more options and protects you if one gateway has an outage.

What happens if a payment fails after my code has already created an order?

This is why webhooks matter. If your code creates an order before confirming the payment succeeded, and then the payment fails, you have an order with no payment. Webhooks let the gateway notify you of the failure so you can cancel the order or mark it as unpaid. The safest approach is to not create an order until the gateway confirms the payment succeeded.

How long does it take for money to appear in my bank account after a customer pays?

This varies by gateway and bank. Most gateways deposit money within one to three business days. Some offer next-day deposits for a higher fee. Check the gateway's documentation for their settlement schedule. Weekend and holiday delays are common.