Guide
What is a payment gateway?
A payment gateway is the secure link between your checkout and the card networks. Here's how a payment moves through one, how it differs from a processor, and what it means for PCI.
Key points
- A gateway takes card details from your checkout, protects them, and sends the payment request on to the processor.
- The customer's bank answers in seconds, but the money settles later, usually in a daily batch.
- All-in-one providers like Stripe and Square include the gateway in their rate; with a separate merchant account you may pay for one, such as Authorize.net.
- Hosted payment pages and embedded fields keep card numbers off your servers and keep PCI compliance simple.
The short definition
A payment gateway is the technology that securely carries card details from a checkout to the payment processor and brings back the customer's bank's answer. For online businesses it does the job a card terminal does in a shop.
How a payment moves through a gateway
The customer enters their card
On a payment page or in payment fields provided by the gateway.
The gateway protects the details
It encrypts the card number and replaces it with a token, so your systems never store the real number.
The request goes out
From the gateway to the processor, then through the card network to the bank that issued the card.
The bank decides
It checks the available balance or credit, its fraud signals, and 3-D Secure if it was used, then approves or declines.
The answer comes back
The same way, usually within a few seconds. The customer sees "Payment successful" or a decline.
Money moves later
Approved payments are captured and settled in batches, and the provider pays out to your bank on its schedule.
Gateway, processor or merchant account?
| Part | What it does | Analogy |
|---|---|---|
| Payment gateway | Captures and protects card details at checkout and sends the request on | The card terminal |
| Payment processor | Moves authorization and settlement messages between banks and networks | The wiring behind the terminal |
| Merchant account | Your agreement with the acquiring bank that lets you accept cards | Permission to take cards at all |
Many providers bundle all three, so you sign up once and pay one rate. With a separate merchant account, you might add a gateway such as Authorize.net, which lists $25 a month plus 10¢ per payment and a 10¢ daily batch fee for its gateway-only plan.
Ways to connect a gateway
- Hosted payment page. The customer pays on a page run by the gateway. Usually the quickest way to start, and card numbers never touch your site.
- Embedded payment fields. Card fields from the gateway sit inside your checkout, so it looks like your page while the card details go straight to the gateway.
- Plugins. Ready-made connections for store platforms such as WooCommerce.
- Direct API. Your own systems send payment requests. The most flexible option, and it brings more of your systems into PCI scope if they handle card data.
Gateways and PCI compliance
The PCI Data Security Standard applies to every business that accepts cards, and how you connect the gateway decides how much work it is.
- SAQ A, the shortest self-assessment, fits businesses whose card details are entered only on the provider's hosted page or fields. Since March 31, 2025, a business filing SAQ A must also confirm its website isn't open to script attacks that could affect its checkout.
- SAQ A-EP fits ecommerce businesses whose own website controls how card details reach the provider, such as a direct-post form.
- SAQ D covers businesses that store, process or transmit card data themselves, and is the longest.
What to look for
- Connections to your platform, and good documentation if you build your own.
- The payment methods you need: cards, Apple Pay and Google Pay, ACH, and others.
- Fraud tools: 3-D Secure, address and security-code checks, limits and block lists.
- Tokens you can take with you: will the provider export customers' saved cards if you leave?
- Clear pricing, reporting, and webhooks for your systems.
Common questions
Do I need a separate gateway if I use Stripe or Square?
No. All-in-one providers include the gateway, the processing and the account in one sign-up.
What's the difference between a gateway and a payment orchestration platform?
A gateway connects you to a processor. An orchestration platform sits above several processors, routing each payment and retrying declines with another one.
Is tokenization the same as encryption?
No. Encryption scrambles the card number so it can be unscrambled with a key. Tokenization swaps it for a stand-in value that's useless if stolen, while the real number stays in the provider's secure vault.
Sources
- Authorize.net pricing, read October 17, 2026
- PCI Security Standards Council
- PCI Security Standards Council: updates for merchants validating to SAQ A (published January 2025, effective March 31, 2025)
- Adyen: SAQ A eligibility, including the March 31, 2025 change
Gateway, processing and payouts in one.
Candor's payment links take card details on Stripe's secure pages, so card numbers never touch your website, and every fee is published.