What a payment gateway does, and what you need before you start
A payment gateway is the tool that captures card details, bank account information, or digital wallet data from your customer and sends it to your processor for approval. It sits between your website, app, or point-of-sale system and the banks involved in the transaction. You cannot accept online payments without one.
Before you contact any gateway provider, you need three things in place: a merchant account (a bank account that receives customer payments), a business bank account (separate from your personal account), and a way to process those payments—either through your own processor or through a gateway that handles processing for you. Some gateways bundle all three; others require you to arrange them separately.
The setup process varies by provider and by how you sell. A Shopify store has a gateway built in. A WordPress site needs a separate gateway plugin. A brick-and-mortar shop needs a physical terminal or mobile reader. The time from application to first transaction ranges from same-day (for some cloud-based platforms) to two weeks (for traditional bank-based gateways that require underwriting).
Key Takeaways
- A payment gateway captures customer payment information and routes it to your processor; you cannot accept payments online without one.
- Gateway setup requires a merchant account, a business bank account, and a processor—some providers bundle all three, others require you to arrange them separately.
- The time from application to first transaction ranges from same-day for cloud platforms to two weeks for bank-based gateways with underwriting.
- Your choice of gateway depends on your sales channel: e-commerce platforms have built-in gateways, websites need plugins or hosted forms, and physical locations need terminals or mobile readers.
- Fees vary by provider and transaction type; compare per-transaction rates, monthly minimums, setup costs, and chargeback fees before signing.
Choosing between hosted, self-hosted, and embedded gateways
A hosted gateway redirects your customer to a payment page you do not control—the gateway's own secure form. Stripe Checkout and PayPal Standard are examples. The advantage is simplicity: you do not store card data, so your security burden is lower. The disadvantage is that customers leave your site to pay, which can increase cart abandonment. Setup is usually fast because the provider handles most of the technical work.
A self-hosted gateway lets you build your own payment form on your website using the gateway's code. Stripe and Square both offer this. You keep customers on your site, which improves the experience, but you must meet PCI DSS (Payment Card Industry Data Security Standard) compliance requirements—a set of security rules that protect card data. Compliance is expensive and ongoing. Setup takes longer because you or a developer must build and test the form.
An embedded gateway is a middle ground: you add a small code snippet to your site, and the gateway handles the form securely within your page. Customers never leave, and you avoid most PCI compliance burden. Stripe Elements and Square Web Payments SDK work this way. Setup is faster than self-hosted but requires some technical work.
If you sell through Shopify, WooCommerce, or another e-commerce platform, the gateway is often built in or pre-integrated. You simply activate it and connect your processor. If you sell in person, you need a terminal or mobile reader—Square Reader, Clover, or Toast are common choices.
The application and underwriting process
Most gateway providers require you to create an account, provide business information, and link a bank account. The information they ask for typically includes your legal business name, tax ID, average monthly transaction volume, and the type of products or services you sell. Some providers also ask for personal credit information if you are a sole proprietor or small partnership.
Traditional banks and some payment processors run underwriting—a review of your business history, credit, and risk profile. This can take five to fourteen days. Cloud-based gateways like Stripe and Square often approve accounts in minutes to hours because they use automated risk scoring instead of manual review. If you are flagged as high-risk (selling internationally, handling high-value items, or operating in certain industries), underwriting takes longer and may require additional documentation.
Once approved, you receive API keys or credentials that connect your website or app to the gateway. For hosted gateways, you may only need a button or link. For self-hosted or embedded gateways, you or your developer will integrate the keys into your code. Testing usually takes a few hours to a day; most providers offer a sandbox environment where you can run fake transactions before going live.
Comparing fees across different gateway types
Gateway fees fall into several categories, and they vary widely by provider. A per-transaction fee is charged on every successful payment—typically 2.2% to 3.5% of the transaction amount plus a flat fee of $0.25 to $0.50. Some gateways charge a lower percentage but a higher flat fee, or vice versa. A $100 transaction might cost $3.45 at one provider and $3.70 at another.
A monthly minimum or monthly fee is charged regardless of transaction volume. Some gateways charge $0 (Stripe, Square); others charge $10 to $50 per month (traditional processors). If you process less than $500 per month, a monthly fee can make a gateway unaffordable. If you process $50,000 per month, the monthly fee is negligible.
A chargeback fee is charged when a customer disputes a transaction and the bank sides with the customer. This fee ranges from $15 to $100 per chargeback. If you have a high chargeback rate, some gateways will terminate your account or raise your per-transaction rate. A setup fee or integration fee is a one-time charge to activate your account, usually $0 to $500. Some gateways charge extra for features like recurring billing, invoicing, or API access.
Build a spreadsheet comparing your expected monthly volume against the fees at three to five providers. A provider with a 2.9% rate and $0.30 per transaction is cheaper than 3.2% and $0.25 if your average transaction is $50, but more expensive if your average is $10. The math changes based on your business.
Connecting your gateway to your sales channel
If you use Shopify, WooCommerce, BigCommerce, or another hosted e-commerce platform, the gateway connection is usually a few clicks. You log into your store settings, select a payment method, enter your gateway credentials, and activate it. The platform handles the technical integration. Most platforms support multiple gateways, so you can offer customers a choice between credit card, PayPal, Apple Pay, and others.
If you have a custom website built on WordPress, you will need a plugin that connects to your chosen gateway. WooCommerce Payments, Stripe for WordPress, and Square for WordPress are common options. The plugin handles the form and the connection; you provide your gateway credentials. If your site is custom-coded, your developer will use the gateway's API documentation to build the integration. This takes longer and costs more but gives you full control over the payment experience.
If you sell in person, you need a physical terminal or mobile reader. Square Reader, Clover, and Toast all connect to your phone or tablet via Bluetooth or headphone jack. You swipe, insert, or tap the card, and the reader sends the data to the gateway. Setup is usually same-day: download the app, link your bank account, and start accepting payments. Some terminals require a separate merchant account; others bundle it with the gateway.
After connecting your gateway, test it with a small real transaction before promoting it to customers. Some gateways charge a small fee for test transactions; others do not. Confirm that the payment appears in your merchant account and that the customer receives a receipt.
Security, compliance, and ongoing management
PCI DSS compliance is a legal requirement if you handle card data. If you use a hosted gateway, the provider handles compliance for you. If you use a self-hosted gateway, you must meet PCI standards—this includes encrypting data, using secure passwords, running regular security audits, and maintaining detailed logs. Non-compliance can result in fines of $5,000 to $100,000 per month, depending on your processor and the severity of the breach.
Most gateways offer fraud detection tools that flag suspicious transactions—unusual amounts, mismatched billing and shipping addresses, or multiple failed attempts. You can set rules to automatically decline high-risk transactions or require additional verification (like a CVV or 3D Secure). Review your fraud settings regularly; overly aggressive rules can decline legitimate customers.
Monitor your chargeback rate. If it exceeds 1% of your transactions, your processor may charge you higher fees or terminate your account. If you see a spike in chargebacks, investigate the cause: are customers not recognizing your business name on their statement? Are you shipping to the wrong address? Are you not delivering what you promised? Fix the root cause rather than just disputing the chargebacks.
Keep your gateway credentials secure. Never share your API keys, merchant ID, or secret keys in email or public code repositories. Rotate your keys periodically. If you suspect a breach, contact your provider immediately and request new credentials.
Troubleshooting common setup problems
If your application is declined, the most common reasons are insufficient business history, a low personal credit score, or a high-risk industry. Ask the provider why you were declined; some will reconsider if you provide additional documentation or adjust your business profile. If one provider declines you, try another—different providers have different risk tolerances.
If transactions are failing after setup, check that your gateway credentials are correct and that your website or app is using the latest API version. Some gateways deprecate old API versions and require you to update your code. Test a transaction in the gateway's sandbox environment to isolate whether the problem is with your integration or with the gateway itself.
If customers report that they were charged twice, check your form code for duplicate submission buttons or accidental double-clicks. Some gateways have built-in duplicate detection; others do not. If the duplicate charge was recent, contact your processor and request a reversal—most will process it within one to three business days.
If your settlement (the money deposited into your bank account) is delayed, check your processor's settlement schedule. Most settle within one to two business days; some take three to five. Weekends and holidays extend the timeline. If a settlement is more than five business days late, contact your processor's support team.
Frequently Asked Questions
Do I need a separate merchant account if I use a gateway like Stripe or Square?
No. Stripe and Square provide merchant accounts as part of their service. You link your business bank account to them, and they deposit your payments there. Traditional processors like First Data or Global Payments may require you to open a separate merchant account with a bank, then connect that account to the processor.
What is the difference between a payment gateway and a payment processor?
A gateway captures and encrypts payment information. A processor submits that information to the card networks and banks for approval. Some companies (Stripe, Square) do both. Others specialize in one: a gateway provider like Authorize.net focuses on capturing data, while a processor like Chase Paymentech focuses on approval and settlement.
Can I use multiple gateways on the same website?
Yes. Most e-commerce platforms support multiple gateways, so customers can choose their preferred payment method. You can offer Stripe for cards, PayPal for PayPal accounts, and Apple Pay for mobile users. Each gateway charges its own fees, so compare the total cost before adding a second provider.
How long does it take to receive my first payment after setup?
Settlement time varies by provider. Stripe and Square typically settle within one to two business days. Traditional processors may take three to five business days. Your first settlement may be delayed if your account is flagged for review. After that, settlements follow the provider's standard schedule.
What happens if my gateway provider goes out of business?
Your money in the merchant account is protected by the FDIC if it is held in a bank account. However, you will need to migrate to a new gateway, which requires updating your website or app code and notifying customers of any changes. Choose a provider with a long track record and strong funding to minimize this risk.