What you need before you start
A payment gateway connects your website or app to the banks and card networks that actually move money. Before you set one up, you need three things in place: a merchant account (a bank account that accepts card payments), a business license or tax ID, and a way to process transactions securely. Some payment gateways bundle the merchant account with the gateway itself; others require you to open one separately. The difference matters because it changes your setup time and which company you call if something breaks.
You also need to decide whether you want a hosted solution (the gateway handles the payment form on their servers) or a self-hosted one (you build the form on your own site). Hosted is simpler and safer for most small businesses because you never touch the customer's card data directly. Self-hosted gives you more control but requires you to meet stricter security standards called PCI DSS compliance—a set of rules that protect card information. Most small businesses choose hosted.
Have your business documents ready: your EIN or Social Security number, a recent bank statement, and your website URL. Some gateways ask for your average monthly transaction volume and your industry type. This information helps them assess risk and determine your processing fees.
Key Takeaways
- You need a merchant account, business license, and a way to process payments securely before you can set up a gateway—some gateways provide the merchant account, others require you to open one separately.
- Hosted payment forms (where the gateway handles the payment page) are simpler and safer than self-hosted forms for most businesses because you do not store card data yourself.
- Your setup time ranges from same-day (for simple gateways like Stripe or Square) to one to two weeks (for traditional processors that require manual underwriting).
- You will pay a combination of per-transaction fees (usually 2.2% to 3.5% plus a flat fee per transaction) and monthly fees, which vary by gateway and your industry.
- Test your gateway with a small transaction before you go live, and keep your API keys and passwords in a secure location that only you and your team can access.
Choosing between integrated and standalone gateways
An integrated gateway is built into a platform you already use—Shopify, WooCommerce, Square Online, or similar. You turn it on, connect your bank account, and you are done. Setup takes minutes. The downside is you pay the platform's fees plus the gateway's fees, and you cannot easily switch to a different gateway without rebuilding your checkout.
A standalone gateway works with any website or app you build yourself. Stripe, Square, Authorize.net, and PayPal are common examples. You install their code (called an API or plugin) on your site, connect your bank account, and configure your settings. This takes longer—usually a few hours to a day—but you keep more control and can switch gateways without rebuilding your whole site. Standalone gateways also tend to have lower per-transaction fees if you process high volume.
If you run a simple online store and do not plan to change platforms, integrated is faster. If you want flexibility or you process thousands of transactions a month, standalone usually costs less over time.
The step-by-step setup process
Start by choosing your gateway and visiting their signup page. You will enter your business name, address, phone number, and email. Most gateways ask for your business type (retail, SaaS, nonprofits, etc.) because different industries have different fraud risk and different rules.
Next, provide your bank account details. This is where the gateway will deposit your money after transactions settle. You will need your routing number and account number, which you can find on a check or in your online banking portal. The gateway will verify this account by depositing two small amounts (usually under a dollar each) and asking you to confirm the amounts. This takes one to three business days.
Then connect your website or app. If you use an integrated platform like Shopify, this is automatic—just flip the switch. If you use a standalone gateway, you will receive an API key and a secret key. These are passwords that let your website talk to the gateway's servers. Copy them into your website's settings or give them to your developer. Never share these keys publicly or paste them into email.
Finally, test the gateway before you accept real payments. Most gateways provide test card numbers that let you run fake transactions. Use these to make sure the payment form appears, the confirmation email sends, and the transaction shows up in your dashboard. Only after a successful test should you flip the switch to live mode and start accepting real money.
Understanding fees and what they cover
Payment gateway fees come in three forms. Per-transaction fees are the biggest: typically 2.2% to 3.5% of the transaction amount plus a flat fee of 20 to 30 cents. A $100 sale might cost you $2.50 to $3.80 in fees. Monthly fees range from zero (for low-volume gateways like Stripe) to $25 to $300 (for traditional processors that include customer support and advanced features). Chargeback fees apply when a customer disputes a charge; these usually run $15 to $100 per dispute.
Some gateways charge extra for specific features: recurring billing, international transactions, ACH transfers, or phone support. Read the pricing page carefully and ask about all fees before you sign up. A gateway that looks cheap at 2.2% per transaction might charge $50 a month, while one at 2.9% might be free. The math depends on your volume.
Your industry affects your rate. Nonprofits and charities often get lower rates. High-risk industries like gambling, adult services, or travel often pay more. If your business is high-risk, some gateways will decline you entirely; you may need to use a specialized processor.
Security and compliance after setup
Once your gateway is live, your main job is keeping your keys and passwords safe. Store your API keys in a password manager, not in a text file on your desktop. If someone steals your keys, they can process fake transactions and drain your account. Rotate your keys every six months or whenever someone with access leaves your team.
If you use a hosted payment form (which most businesses do), the gateway handles PCI compliance for you. If you build your own form, you are responsible for meeting PCI DSS standards, which means encrypting data, using firewalls, and passing annual security audits. This is expensive and complicated; most small businesses avoid it by using hosted forms.
Monitor your transactions regularly. Log into your gateway dashboard at least weekly and look for unusual activity: refunds you did not authorize, chargebacks, or failed transactions that repeat. Most gateways let you set up alerts for large transactions or unusual patterns. Report fraud immediately; gateways have fraud teams that can freeze accounts and investigate.
Troubleshooting common setup problems
If your bank account verification fails, the gateway could not confirm the two small deposits you received. Check your bank statement to see if the deposits arrived, and re-enter the amounts exactly. If they never arrived, contact the gateway's support team; they may need to try again or use a different verification method.
If your test transaction fails, check that you are using the correct test card number for your gateway (Stripe, Square, and Authorize.net all have different test cards). Make sure you are in test mode, not live mode. If the error message says "invalid API key," you copied the key wrong or you are using a live key in test mode (or vice versa). Copy the key again directly from your dashboard, not from an email or document.
If your website cannot connect to the gateway at all, your developer may have entered the wrong endpoint URL. Each gateway has a specific URL that your website sends data to; if it is wrong by even one character, the connection fails. Ask your developer to check the gateway's documentation and verify the URL matches exactly.
If you are approved for a merchant account but your gateway says you are not, you may have signed up for the gateway before your merchant account was fully activated. Wait 24 hours and try again. If it still does not work, contact the gateway's support team with your merchant account number.
Switching gateways or adding a second one
If you outgrow your first gateway or find a cheaper option, you can switch. The process depends on your setup. If you use an integrated platform like Shopify, you disable the old gateway and enable the new one; your checkout form updates automatically. If you use a standalone gateway, your developer removes the old API keys from your code and installs the new gateway's code. This takes a few hours but causes no downtime if done correctly.
Some businesses use two gateways at once for redundancy: if one goes down, the other keeps processing. This requires your developer to code a fallback, so the website tries the first gateway and switches to the second if the first fails. This adds complexity and cost but protects you against outages.
Before you switch, export your transaction history from your old gateway. Most gateways let you download a CSV file of all transactions. Keep this for your records and for tax purposes. You do not need to keep processing old transactions through the old gateway; once you switch, new transactions go through the new one.
Frequently Asked Questions
How long does it take to get approved for a payment gateway?
Simple gateways like Stripe or Square can approve you in minutes to a few hours if you provide your information online. Traditional processors that require manual underwriting take one to two weeks. If your business is high-risk or you have a poor credit history, approval can take longer or be denied. You will receive an email confirming approval; do not go live until you see it.
What happens if a customer disputes a charge after I process it?
The customer's bank contacts your gateway, which notifies you. You have a window (usually 7 to 10 days) to respond with proof that the transaction was legitimate: an order confirmation, a shipping receipt, or a signed contract. If you provide proof, you usually keep the money. If you do not respond or your proof is weak, the bank sides with the customer and reverses the charge. You also pay a chargeback fee of $15 to $100.
Can I use the same gateway for my website and my mobile app?
Yes. Most gateways provide separate API keys for web and mobile, but they connect to the same merchant account and the same bank account. Transactions from both sources show up in the same dashboard. You may need to register your app separately with the gateway for security reasons, but the setup is straightforward.
What if I process payments in multiple countries?
Many gateways support international transactions, but fees and features vary. Some charge extra for currency conversion (usually 2% to 3% on top of your regular fees). Others require you to open separate merchant accounts in each country. Check your gateway's international pricing before you launch in a new market, because the cost difference can be significant.
Do I need to keep my gateway running 24/7?
Your gateway's servers run 24/7, but you do not have to. Your website can be down for maintenance and your gateway will still work when you come back online. However, if your gateway's servers go down, you cannot process payments until they recover. Most major gateways have 99.9% uptime, which means they are down less than an hour per month on average.