What Is a Payment Gateway? An Explainer From the Team That Configures Them Every Day

A payment gateway is the software that captures, encrypts, and transmits card data from your checkout to the payment processor for authorization. It is the online equivalent of a card terminal, and every ecommerce transaction passes through one in under 3 seconds.

What Does a Payment Gateway Actually Do?

A gateway performs 5 jobs on every transaction:

• Captures card data at checkout through a form, API, or hosted page
• Encrypts and tokenizes the data so raw card numbers never touch your server
• Routes the transaction to the processor and card networks for authorization
• Returns the approval or decline to your website in 2 to 3 seconds
• Stores tokens for refunds, rebills, and one-click checkout

The gateway does not move money. Settlement runs through your merchant account, which is why the 2 services are usually sold together but priced separately.

How Is a Gateway Different From a Processor?

The gateway transmits data while the processor moves money. Think of the gateway as the secure messenger and the processor as the bank courier. Configured together, our payment gateway solutions pair with ecommerce payment processing so merchants get 1 statement, 1 support line, and 1 point of accountability.

That accountability point matters more than features. When a gateway and processor blame each other for a settlement problem, the merchant loses, a dynamic we cover in payment processors sell infrastructure, not accountability.

Who Needs a Payment Gateway?

Any business accepting cards without the physical card present needs a gateway. That covers 4 groups we set up weekly: online stores, subscription companies running recurring billing, service firms sending payment-enabled invoices, and phone-order businesses taking MOTO payments through a virtual terminal.

How Much Does a Payment Gateway Cost?

Gateways cost $0 to $25 per month plus $0.05 to $0.10 per transaction, though bundled processing plans often waive both. Watch for 3 add-on fees like tokenization charges, API access fees, and PCI fees stacked on top. A $10 monthly fee is trivial; a $0.10 surcharge on 20,000 monthly transactions is $2,000 a year.

What Security Does a Gateway Add to Your Checkout?

A gateway adds 4 security layers your website could not safely build alone:

• Point-of-entry encryption before card data leaves the customer's browser
• Tokenization so stored credentials are useless if your database is breached
• Fraud screening rules like AVS, CVV, and velocity checks on every attempt
• PCI-certified infrastructure that shrinks your own compliance scope

That last layer has a dollar value. Merchants using hosted or tokenized gateway setups complete the shortest PCI questionnaire, avoiding assessments that cost $5,000 and up for merchants storing card data themselves.

How Do You Evaluate Gateway Uptime and Support?

Evaluate a gateway on 99.9%+ uptime history and 24/7 human support, because every minute of gateway downtime is 100% of your online revenue. Ask for the status page before you sign, and test the support line once during onboarding.

Do You Need a Gateway for In-Person Sales?

In-person sales do not require a separate gateway, because modern terminals and POS systems include the same routing function built in. Gateways matter when card data arrives without the card present.

Businesses selling through both channels benefit from a gateway that unifies reporting anyway. Seeing counter sales, online orders, and invoice payments in 1 dashboard turns reconciliation from a chore into a glance.

How Do You Choose Between Gateway Providers?

Choose on 4 criteria in order: integration with your existing sales channels, fee transparency, support availability, and token portability. Feature lists converge across providers, so the differences that matter operationally are the ones you only discover after signing. Ask about all 4 before you do.

Related Gateway Topics We Get Asked About

Hosted vs Integrated: Which Checkout Wins?

Hosted pages outsource security and get you live in 1 day, while API integrations keep customers on your site and convert better. Volume and developer resources decide it.

Does Industry Change Gateway Requirements?

Yes, healthcare merchants need HIPAA-conscious configurations, telehealth providers need card-on-file tokenization, and high-risk businesses need gateways that support their processor's underwriting rules.