← Reference · Home · Print this page
Finance · Payments
Payment Gateway
Reference entry · last updated 20260911
A payment gateway is a software service that captures, encrypts, and transmits payment instructions between a merchant’s checkout interface and payment processing networks.[1]
1. First principles: data transport and isolation
In online commerce, the merchant’s web server cannot safely connect directly to banking settlement networks. A payment gateway acts as the secure entry point. It accepts checkout payloads, applies format validation and cryptographic protection, and marshals requests into downstream protocols (such as ISO 8583 or proprietary banking APIs).[1][2]
2. Gateway versus processor versus acquirer
Modern payment companies frequently bundle these components into full-stack PSPs, but they perform distinct operational functions:[1]
- Gateway: The front-end application layer. It handles merchant API requests, checkout SDKs, hosted fields, basic fraud checks, and payload encryption.[1]
- Payment processor: The technical infrastructure operator that communicates directly with card networks (Visa, Mastercard) and electronic clearing houses.[1]
- Merchant acquirer: The licensed bank or financial institution that holds the merchant account, sponsors network access, assumes financial risk, and settles actual monetary funds into the merchant’s bank account.[1][3]
3. Integration patterns and PCI implications
Gateways offer multiple integration patterns that determine merchant engineering effort and PCI DSS compliance burdens:[4]
- Hosted checkout / redirect: The merchant redirects the customer to a payment page hosted completely on gateway infrastructure. The merchant server never sees card details, which may qualify for SAQ A subject to all eligibility criteria and the compliance-accepting entity's requirements.[4]
- Hosted fields / iframes: Individual card number and CVV form inputs are loaded inside secure iframes hosted by the gateway, while the surrounding checkout UI resides on the merchant’s site. The client browser communicates card data directly to the gateway, receiving a surrogate token in return.[2][4]
- Direct API (Server-to-Server): The merchant server collects card data directly and submits it via API calls to the gateway. This architecture exposes merchant servers to raw Primary Account Numbers (PANs), triggering full PCI DSS assessment (SAQ D).[4]
4. Multi-acquirer routing and resiliency
Independent payment gateways provide payment orchestration across multiple acquiring banks. Gateways can dynamically route transactions based on cost, card brand, currency, issuing region, or target approval rates.[1]
When an acquiring bank experiences an outage or transient technical decline, resilient gateways can retry the transaction across alternative processing paths using stored network tokens.[2]
5. See also
- Payment Service Providers (Merchant Payments)
- ActiveMerchant (Ruby Payments Library)
- Card Authorization and Capture
- Payment Tokenization
- PCI DSS (Payment Card Data Security)
- Online Payments
- Interchange (Card Payments)