What you need before you start
A payment gateway sits between your website and the bank or payment processor that actually moves money. To add one, you need three things in place first: a merchant account (which lets you accept card payments), a website that can receive customer data, and a way to store or forward that data securely to the gateway.
Most gateways require you to sign up for an account with them directly, not through your website host. You will get API credentials — usually a public key and a secret key — that you paste into your website code or into a plugin. The gateway then handles the encrypted connection between your customer's browser and the payment processor, so your server never touches the raw card number.
Before you choose a gateway, check whether your website platform has built-in support for it. WordPress sites can use plugins like WooCommerce or Gravity Forms. Shopify has its own built-in gateway system. Custom-built sites need a developer who can write the integration code or use a pre-built SDK (software development kit) that the gateway provides.
Key Takeaways
- You need a merchant account, a gateway account, and a website capable of receiving and forwarding payment data securely before you can process any transaction.
- Most gateways provide API credentials and SDKs that your developer uses to connect your checkout form to the payment processor.
- Popular gateways like Stripe, Square, and PayPal have different fee structures, supported payment methods, and ease of setup — compare them based on your transaction volume and customer base.
- Test mode lets you run fake transactions before going live, and you must keep your API keys secret and never hardcode them into public code.
- PCI compliance (Payment Card Industry standards) is required by law; most gateways handle it for you if you use their hosted checkout or tokenization.
Choosing between hosted checkout and API integration
A hosted checkout means your customer leaves your site, enters payment details on the gateway's secure page, and returns to you with a confirmation. This is simpler to set up because the gateway handles all the security compliance. Stripe Checkout, PayPal Standard, and Square Payment Form are examples. You embed a button or link on your site, and the gateway does the rest.
An API integration
Hosted checkout is faster to launch and requires less developer time. API integration is better if you want a seamless checkout experience that never leaves your domain, or if you need to combine payment with other data collection on the same form. Most small businesses start with hosted checkout and move to API integration later as they grow.
Step-by-step setup for the most common gateways
Stripe is one of the most developer-friendly options. Create a Stripe account, go to the Developers section, and copy your API keys (publishable and secret). If you are using WordPress with WooCommerce, install the Stripe plugin, paste your keys into the settings, and turn on test mode first. If you are building custom code, use Stripe's JavaScript library to create a payment element on your form, then use your server-side code to create a payment intent and confirm it. Stripe's documentation includes code examples for most languages.
PayPal offers both hosted checkout (PayPal Standard) and API integration (PayPal Commerce Platform). For hosted checkout, you create a button in your PayPal account and embed the code on your site — no developer needed. For API integration, you will need your Client ID and Secret, which you use to authenticate requests to PayPal's servers. PayPal's SDK handles the front-end display and tokenization.
Square works well for businesses that also use Square's in-person payment terminals. Create a Square account, generate your API key from the Developer Dashboard, and use Square's Web Payments SDK to build your checkout form. Square handles tokenization automatically, so you never see the raw card data. Test mode is built in — use test card numbers provided in Square's documentation.
For all three, the process is: create an account, get your API credentials, install the gateway's plugin or SDK on your site, paste the credentials into your settings, test with fake transactions, then flip the switch to live mode.
Testing before you go live
Every gateway provides test mode and test card numbers. Use them. In test mode, transactions do not charge anyone and do not hit the real banking network. Your gateway will give you a specific test card number (usually something like 4242 4242 4242 4242 for Visa) and instructions for what expiration date and CVC to use.
Run at least these tests: a successful payment, a declined card (the gateway provides a test number for this), a payment that requires 3D Secure authentication (if you support it), and a refund. Check that your confirmation email sends, that your order appears in your database, and that the payment shows up in your gateway dashboard with the correct amount and description.
Do not skip test mode. Many sites go live and discover that their confirmation emails are broken, or that the payment amount is being recorded in cents instead of dollars, or that refunds are not working. All of these are easy to fix in test mode and painful to fix after customers have paid.
Security and PCI compliance
PCI DSS (Payment Card Industry Data Security Standard) is a set of rules that apply to anyone who handles card data. The short version: never store raw card numbers on your server, never send them unencrypted, and never hardcode your API keys into your website code where someone could read them in a public repository.
Most modern gateways handle PCI compliance for you if you use their hosted checkout or if you tokenize the card data on the client side (in the customer's browser) before sending it to your server. This means your server only ever sees a token, not the card number itself. Stripe, PayPal, and Square all do this automatically.
Store your API keys in environment variables or a secure configuration file that is not uploaded to version control. If you use GitHub or another public repository, add your config file to .gitignore so it never gets pushed. If you think someone has seen your secret key, regenerate it immediately in your gateway dashboard — the old one will stop working.
Handling payment failures and retries
Not every payment succeeds on the first try. A card might be declined because of insufficient funds, a fraud hold, or an expired card. Your gateway will return an error code telling you why. Common codes include "card_declined", "expired_card", "insufficient_funds", and "lost_card".
Build your checkout form to show the customer the error message and let them try again with a different card or payment method. Do not retry automatically without asking — if a card is declined, charging it again immediately usually fails again and frustrates the customer. Some gateways offer automatic retry logic for specific error types (like temporary network failures), but you control whether to use it.
For subscription or recurring payments, most gateways will retry a failed payment a few times over several days before giving up. You can usually configure how many retries and how far apart they are. If a payment fails after all retries, send the customer an email asking them to update their payment method.
Fees, settlement, and what happens after payment
Every gateway charges fees. Stripe and Square typically charge 2.9% plus $0.30 per transaction for card payments, though rates vary by country and payment method. PayPal charges 2.2% plus $0.30. These fees come out of the money that lands in your bank account — you do not pay them separately.
Settlement is the process of money moving from the gateway to your bank account. Most gateways settle daily or next business day, though some hold funds for a few days if your account is new or if they detect unusual activity. Check your gateway dashboard to see your settlement schedule and to confirm that deposits are hitting your bank account on time.
After a payment succeeds, your gateway sends a webhook (an automated message) to your website telling you the payment is complete. Your code should listen for this webhook and update your database — mark the order as paid, send a confirmation email, trigger a download link, or whatever your business needs. Do not rely only on the customer being redirected back to your site, because they might close the browser before the redirect happens. The webhook is your safety net.
Frequently Asked Questions
Do I need a merchant account separate from my gateway account?
It depends on the gateway. Stripe and Square act as your merchant account — you sign up with them and they handle everything. PayPal also acts as your merchant account. Some older gateways require you to open a merchant account with a bank first, then connect the gateway to it. Check the gateway's documentation or ask their support team before you sign up.
Can I use multiple payment gateways on the same website?
Yes. Many sites offer Stripe, PayPal, and Apple Pay all on the same checkout form so customers can pick their preferred method. Each gateway gets its own API credentials and settings. Your checkout code routes the payment to whichever gateway the customer chose. This increases your approval rate because different customers trust different payment methods.
What happens if a customer disputes a charge?
The customer contacts their bank or card issuer and claims the charge was unauthorized or that they did not receive what they paid for. The gateway notifies you of the dispute, and you have a window (usually 7 to 10 days) to respond with evidence — an order confirmation, a shipping receipt, a delivery signature, or a message from the customer saying the charge was correct. If you do not respond or if the evidence is weak, the customer wins and the money goes back to them.
What is the difference between a payment gateway and a payment processor?
A gateway is the software that encrypts and routes the payment data. A processor is the company that actually moves the money between banks. Stripe is both a gateway and a processor. PayPal is both. Square is both. Some gateways (like Authorize.net) are just the gateway — they route data to a separate processor. For most small businesses, using an all-in-one like Stripe or Square is simpler.
Can I accept payments without a website?
Yes. Square, PayPal, and Stripe all offer payment links — you generate a unique URL, send it to a customer via email or text, and they pay on that page. No website needed. This works for invoices, donations, or one-off sales. If you need to take payments regularly, a website or a point-of-sale system is more practical.