What a crypto payment gateway does, and what you need to build one
A cryptocurrency payment gateway is software that lets merchants accept digital currency—Bitcoin, Ethereum, stablecoins, or others—and converts it to fiat money (dollars, euros) if they want it. You are building a system that sits between a customer's wallet, the blockchain, and a merchant's bank account. The gateway watches for incoming transactions, confirms they arrived, handles the conversion, and moves the money where it needs to go.
Building one requires four separate pieces: a way to generate payment addresses for each transaction, a blockchain monitor that watches for incoming funds, a conversion engine that swaps crypto to fiat if the merchant wants it, and a settlement system that moves money to the merchant's bank. You also need to handle refunds, store transaction records, and comply with money transmission laws in the places where you operate.
Most people do not build a gateway from scratch. They either integrate an existing one (like BTCPay Server, Coinbase Commerce, or Stripe's crypto option) into their website, or they build on top of a blockchain API service (like Alchemy, Infura, or QuickNode) that handles the hard parts. Building entirely from the ground up means writing code to talk to blockchain nodes, managing private keys, handling security at a level most small operations cannot sustain, and obtaining money transmission licenses in every jurisdiction where you want to operate.
Key Takeaways
- A working gateway needs four layers: address generation, blockchain monitoring, currency conversion, and settlement to a bank account.
- Most builders use an existing platform (BTCPay, Coinbase Commerce) or a blockchain API service rather than writing everything from scratch.
- You must obtain a money transmission license in each state or country where you want to operate, which takes months and costs thousands of dollars.
- Private key management and security are the hardest parts—a breach exposes customer funds and your liability is unlimited.
- Starting with a testnet (a practice blockchain) lets you build and test without spending real money.
The technical layers you need to build or integrate
The first layer is address generation. When a customer checks out, your gateway creates a unique wallet address for that transaction. This address is derived from a master key using hierarchical deterministic (HD) derivation, which means you can generate thousands of addresses from one seed without storing each one separately. Libraries like BIP32 handle this math. You store the master key in a hardware security module (HSM) or a key management service (KMS)—never on a regular server.
The second layer is blockchain monitoring. Your system watches the blockchain for incoming transactions to those addresses. You do this by running a full node (which stores the entire blockchain and takes weeks to sync) or by querying a node-as-a-service provider like Infura or Alchemy. These providers run the nodes for you and give you an API to ask "has this address received funds?" They charge per API call, typically $0.01 to $0.10 per thousand calls depending on the network and provider.
The third layer is currency conversion. If a merchant wants to receive dollars instead of Bitcoin, you need to sell the Bitcoin immediately or hold it and sell later. This means integrating with an exchange API (Kraken, Coinbase Pro, Gemini) or a liquidity provider. You also need to decide who bears the price risk: if Bitcoin drops 5% between when the customer sends it and when you convert it, does the merchant lose that 5%, or do you? Most gateways pass the risk to the merchant and complete the conversion within minutes.
The fourth layer is settlement. After conversion, the fiat money sits in your exchange account. You need to move it to the merchant's bank account. This usually means using the exchange's withdrawal API to send money to a bank account you control, then using ACH or wire transfer to send it to the merchant. Each step takes a day or more and costs money—ACH is $0.25 to $1 per transaction, wires are $15 to $50.
Choosing between building from scratch and using an existing platform
Building from scratch means writing code to handle all four layers yourself. You write the address generation logic, run or query blockchain nodes, integrate with exchanges, and manage bank transfers. The advantage is complete control and no per-transaction fees from a middleman. The disadvantages are enormous: you need a team of experienced blockchain engineers, you must handle security at a level that requires constant auditing, you need to obtain money transmission licenses (see below), and you are liable for every cent that goes through your system.
Using an existing platform like BTCPay Server (open-source, self-hosted) or Coinbase Commerce (hosted, managed by Coinbase) means you integrate their API into your website. The merchant's customer pays into an address that BTCPay or Coinbase controls. BTCPay then notifies your website that payment arrived, and you fulfill the order. You do not hold customer funds or private keys. BTCPay charges nothing; Coinbase charges 1% per transaction. You still need to handle refunds and customer service, but you avoid the security and licensing burden.
A middle path is building on top of a blockchain API service. You write the business logic (checkout flow, order tracking, refund handling) but use Alchemy or Infura to handle blockchain queries, and you use a custody service like Fireblocks or Copper to hold private keys. This reduces your security burden but still requires money transmission licensing if you are holding customer funds.
Money transmission licensing and regulatory requirements
If your gateway holds customer funds—even for a few seconds—you are a money transmitter in the eyes of the law. This means you need a license in every state where you want to operate. The process varies by state but generally requires:
- A completed application (50 to 200 pages depending on the state)
- Proof of net worth or a surety bond (usually $25,000 to $500,000 per state)
- A detailed description of your business, technology, and security practices
- Background checks on all owners and officers
- Proof of compliance with anti-money-laundering (AML) and know-your-customer (KYC) rules
Processing time ranges from three months to two years. New York's BitLicense, for example, is notoriously slow and expensive. If you want to operate in all 50 states, you are looking at $500,000 to $2 million in licensing costs and 18 to 36 months of waiting.
If you use an existing platform like Coinbase Commerce or BTCPay Server and never touch customer funds, you may not need a money transmitter license—Coinbase holds the funds, not you. But you should consult a lawyer in your jurisdiction, because the rules are still evolving and some states take a broad view of what counts as money transmission.
You also need to comply with AML and KYC rules. This means collecting identity information from merchants and customers, checking them against sanctions lists, and reporting suspicious activity. Services like Chainalysis and TRM Labs provide APIs that check blockchain addresses against known bad actors.
Private key management and security architecture
The biggest risk in running a crypto gateway is losing or exposing private keys. A private key is a number that lets anyone spend the funds in a wallet. If someone steals your master key, they can generate all your customer addresses and steal all the funds flowing through your system.
The standard approach is multi-signature wallets. Instead of one private key, you require two or three keys to sign a transaction. You might store one key in a hardware security module in your office, one with a custody provider like Fireblocks, and one with a third-party escrow service. To move money, you need signatures from at least two of the three. This means no single person or breach can steal funds.
You also need to separate hot wallets (connected to the internet, holding small amounts for immediate payouts) from cold wallets (offline, holding most funds). A hot wallet might hold $10,000 and get refilled from cold storage once a day. A cold wallet holds $1 million and never touches the internet.
Every transaction should be logged and audited. You need to know who authorized each withdrawal, when, and why. This audit trail is required by regulators and helps you detect theft or fraud.
Testing on a testnet before going live
Before you process real money, test everything on a testnet. Bitcoin has Bitcoin Testnet, Ethereum has Sepolia, and most blockchains have a practice version where transactions are free and funds have no real value.
On testnet, you can:
- Generate addresses and verify they work
- Send test transactions and confirm your monitoring system detects them
- Test refunds, failed transactions, and edge cases
- Load-test your system with thousands of simultaneous transactions
- Verify that your settlement process works end-to-end
Testnet faucets (free services) give you test coins so you can send transactions without spending money. This phase usually takes weeks to months depending on how thorough you want to be. Do not skip it—bugs found on testnet cost nothing; bugs found after launch cost everything.
Common pitfalls and how to avoid them
The most common mistake is underestimating security. Developers often store private keys in environment variables or config files, thinking "we will fix it later." Later never comes, and a junior engineer accidentally commits the key to GitHub. Use a key management service from day one.
The second mistake is not planning for volatility. If you accept Bitcoin and convert to dollars, the price can move 10% in an hour. If you do not convert immediately, you bear that risk. If you do convert immediately, you pay exchange fees. Decide your strategy before you launch and communicate it clearly to merchants.
The third mistake is ignoring regulatory requirements until you are already operating. Regulators do not care that you did not know you needed a license. They fine you, shut you down, and sometimes prosecute. Talk to a lawyer who specializes in money transmission before you write a single line of code.
The fourth mistake is poor customer support. When a transaction fails or a refund is delayed, merchants need to reach a human quickly. Build a support system before you launch, not after.
Frequently Asked Questions
Do I need to run my own blockchain node?
No. Node-as-a-service providers like Infura, Alchemy, and QuickNode run nodes for you and provide an API. You pay per API call (usually $0.01 to $0.10 per thousand calls). Running your own node is cheaper at scale but requires server infrastructure, technical expertise, and weeks of sync time. Most startups use a service provider.
What happens if a customer sends funds to the wrong address?
Blockchain transactions are irreversible. If a customer sends Bitcoin to an address you did not generate for them, that money is gone. Your gateway should display the address clearly and let the customer copy-paste it to avoid typos. Some gateways show a QR code to eliminate manual entry. You cannot recover funds sent to the wrong address.
How long does it take for a transaction to confirm?
Bitcoin typically confirms in 10 to 60 minutes depending on network congestion and the fee paid. Ethereum is faster, usually 12 to 30 seconds. Stablecoins on Ethereum or Polygon are even faster. Your gateway should show the customer the confirmation time and let them know when their payment is final. Most gateways consider a transaction confirmed after one or two blocks.
Can I accept multiple cryptocurrencies with one gateway?
Yes, but each blockchain requires its own address generation, monitoring, and settlement logic. If you accept Bitcoin, Ethereum, and USDC, you need to monitor three separate blockchains and handle three separate conversion and settlement flows. This complexity grows quickly. Most startups begin with one or two cryptocurrencies and add more later.
What if I want to hold crypto instead of converting to fiat?
You still need a money transmitter license in most jurisdictions, because you are holding customer funds. You also need secure storage (hardware wallets, custody services) and insurance in case of theft or loss. The regulatory burden does not decrease just because you are not converting to fiat.