Payments glossary · Core
Payment Gateway
A payment gateway is the technology that securely captures payment details at checkout, passes the transaction to an acquirer or processor for authorisation, and returns the result to the merchant's website, app or terminal.
How Payment Gateway works
The gateway sits between the merchant's checkout and the payment networks. It encrypts card data, formats the authorisation request, applies fraud checks or 3-D Secure where configured, and handles follow-up actions such as capture, void and refund. Many gateways also store cards as tokens for repeat payments and connect to alternative payment methods.
The integration style affects security and compliance. The PCI Security Standards Council describes several e-commerce options: redirecting the customer to a payment page hosted by the provider, embedding the provider's page in an iframe, having the merchant's own page post card data directly to the provider, or sending card data through the provider's API from the merchant's servers. Redirect and iframe approaches keep card data off the merchant's systems and can qualify for the shortest self-assessment questionnaire (SAQ A); direct post and API models bring more of the merchant's environment into PCI DSS scope.
Some providers sell the gateway on its own and let the merchant bring its own acquirer; others bundle gateway and acquiring as a single PSP service. A gateway that connects to several acquirers is the starting point for routing, cascading and payment orchestration.