Payment Gateway

A payment gateway is a service that collects or receives payment details, protects their transmission, and connects a merchant’s checkout to a payment processor or acquirer. It carries payment information and responses between these systems. Gateways support online and app payments and can also serve in-person payment systems, handling cards and supported wallets or other electronic payment methods.

How Authorization Works

In a typical card payment, the customer submits payment details at checkout. The payment gateway sends an authorization request to a payment processor, typically working with the merchant’s acquirer. The request then travels through the relevant card network to the issuer—the bank or institution that issued the customer’s card.

The issuer assesses available funds or credit alongside account status and security checks before approving or declining the request. Its response returns through the processing chain to the gateway and checkout, allowing the merchant to display the result to the customer. The gateway relays this decision rather than independently deciding whether the customer’s bank should approve. A decline means the requested authorization was not granted; it does not necessarily mean the customer has insufficient funds.

Authorization, Capture and Settlement

An approved card authorization typically places a hold on the relevant funds or available credit, but it does not mean money has reached the merchant. Capture submits the authorized payment for subsequent processing. Capture may follow authorization automatically or occur later, depending on the merchant’s setup. Clearing exchanges and reconciles transaction details, while settlement moves funds between the participating financial institutions. The timing of the merchant’s payout depends on its provider arrangement.

A payment gateway primarily handles payment information and messages, while processors and banking infrastructure handle payment execution and settlement. A merchant account is a banking arrangement for accepting card payments and receiving their proceeds, not the checkout interface or messaging service. Providers may bundle gateway, processing and merchant-account services, but these remain distinct functions. Approval alone therefore should not be treated as confirmation of a completed payout.

Security and Integration

Using a payment gateway can reduce exposure to sensitive payment data through protected data handling, including encryption during transmission. Some services also offer tokenization, which substitutes a reference for card details, and fraud-screening tools. These capabilities vary by provider and reduce particular risks rather than guaranteeing fraud prevention or complete security. An issuer’s approval is not a guarantee that a transaction is legitimate or immune to a later dispute.

Provider-hosted checkout can reduce implementation work and the amount of card data a merchant handles, but it may limit control over the checkout experience. More customized integrations can offer greater control while requiring additional engineering, maintenance and security work. A checkout displayed on the merchant’s site does not necessarily mean sensitive payment data passes through the merchant’s servers. Outsourcing checkout also does not eliminate the merchant’s security obligations or applicable Payment Card Industry Data Security Standard (PCI DSS) responsibilities; the integration affects their scope.

Coverage and Costs

Choosing a payment gateway depends on supported payment methods, countries, currencies and compatibility with the merchant’s existing systems. Wallet support does not automatically mean every underlying payment method or geographic market is covered. Costs can include transaction charges, recurring fees and additional charges for particular services, depending on the provider and merchant arrangement. Compare the total cost of the required services rather than assuming gateway pricing includes processing and banking charges. Integration effort, security responsibilities and access to technical support also matter, especially when diagnosing failed requests or missing checkout responses.