What Is a Payment Gateway? How Online Payments Get Approved
Learn what a payment gateway does, how it moves an online card payment from checkout to approval, and which features and fees to compare before choosing.
Photo: Pixabay
On this page 8 sections
- Payment Gateway Meaning: The Online Card Terminal
- How Does a Payment Gateway Work? From Checkout to Approval
- Hosted, Integrated, and API Gateways
- Key Gateway Features: Tokenization, Fraud Filters, Recurring Billing
- Payment Gateway Fees: Setup, Monthly, and Per-Transaction
- Do You Need a Separate Gateway or Is It Bundled?
- Choosing an Ecommerce Payment Gateway That Fits Your Shopping Cart
- Next Steps
Key takeaways
- A payment gateway securely carries card data from your checkout or virtual terminal to your processor, then returns an approval or decline in seconds.
- Authorization, capture and settlement are separate steps. Knowing which one your gateway handles helps you troubleshoot declines and deposit timing.
- Gateway costs usually include a setup fee, a monthly fee and a per-transaction fee. These are separate from card-processing costs, so compare both.
- Choose a gateway that works with your shopping cart, your processor and your billing model, and confirm that you can move your stored card tokens if you switch.
A payment gateway is the technology that lets your business accept card payments where there's no physical terminal. That includes a website checkout, a phone order keyed into a browser, and a monthly subscription charge. This guide follows one online card payment through the gateway from start to finish. It then covers the gateway types you'll come across, the features worth paying for, how gateway fees are usually structured and how to choose one that fits your shopping cart.
If you sell online, take card payments over the phone or bill customers on a recurring schedule, the gateway handles every one of those transactions. Understanding it makes declines, fees and deposit timing much easier to follow.
Payment Gateway Meaning: The Online Card Terminal
In a store, a customer taps or inserts a card at a terminal, and the terminal sends the transaction to your processor. Online, there's no device on the counter. The payment gateway does the terminal's job in software.
It has three core tasks:
- Collect card details securely from a checkout page, a virtual terminal or a saved customer profile.
- Transmit the encrypted data to your payment processor in the format the processor expects.
- Return the result, approved or declined, to your website or software so the order can continue.
The gateway is not your merchant account, and it is not the processor. The merchant account is the relationship that lets you accept cards and receive funds. The processor moves transactions through the card networks. The gateway is the secure connection between your sales channel and that system. For a wider view of how these pieces fit together, see our guide to what merchant services include.
How Does a Payment Gateway Work? From Checkout to Approval
Here is what happens in the few seconds after a customer clicks "Place Order." The example below is illustrative.
Illustrative example: A customer buys a pair of running shoes from an online store and pays with a Visa credit card.
- Card entry. The customer types the card number, expiration date, CVV and billing address into the checkout form.
- Encryption and handoff. The gateway encrypts the data and sends an authorization request to the store's processor. Depending on your settings, it may first run fraud checks such as address verification (AVS) and CVV matching.
- Routing. The processor sends the request through the card network, in this case Visa, to the bank that issued the customer's card.
- Issuer decision. The issuing bank checks available credit, account status, fraud signals and the AVS and CVV results. It then approves or declines. For some card brands, the network and the issuer are the same company.
- Response. The answer travels back along the same path: issuer, network, processor, gateway. The gateway passes it to your website, which shows either a confirmation page or a "payment declined" message.
- Capture. An approval places a hold on the customer's funds but does not move money. You still need to capture the transaction. Some merchants capture right away. Others capture when the order ships.
- Settlement. Captured transactions are grouped into a batch, usually once a day, and submitted for settlement. The issuer pays the network, the network pays your acquiring bank, and the funds are deposited to your business bank account.
| Step | Who Handles It | What Can Go Wrong |
|---|---|---|
| Card entry | Customer, your checkout | Typos, abandoned checkout |
| Encryption and fraud checks | Gateway | Filters set too strict or too loose |
| Routing | Processor, card network | Rare outages, misconfigured accounts |
| Approval decision | Issuing bank | Insufficient funds, suspected fraud |
| Capture | You or your software | Uncaptured orders that never get paid |
| Settlement and deposit | Processor, acquiring bank | Batch not closed, holds, reserves |
When a payment fails, the decline code returned in step 5 usually tells you why. Our breakdown of credit card decline codes and what to do about each one can help you sort real problems from fixable ones. If you're wondering why money arrives on a particular day, read how batches, weekends and holidays affect deposits.
Authorize-Only vs. Authorize-and-Capture
Most gateways let you choose between two modes:
- Authorize and capture (sale): One step. This suits digital goods, services billed at the time of purchase and subscriptions.
- Authorize only, capture later: This suits physical goods that ship later and services with a final amount that may change.
Authorizations don't last forever, and card network rules shape when you should capture. Ask your provider how long holds typically remain valid for your card mix and business type.
Hosted, Integrated, and API Gateways
Gateways connect to your business in different ways. The method you choose affects your checkout experience, your development work and your PCI DSS responsibilities.
| Type | How It Works | Best Fit | PCI DSS Impact |
|---|---|---|---|
| Hosted payment page | Customer is redirected to, or shown, a payment page run by the gateway | Small stores, simple setups | Card data never touches your server, which generally lightens your compliance work |
| Integrated (embedded fields or plugin) | Payment fields sit inside your checkout and are served by the gateway | Most shopping carts | Usually lighter than handling raw card data, but confirm with your provider |
| Direct API | Your software sends card data to the gateway yourself | Custom platforms, SaaS, high volume | Broadest compliance scope, since your systems handle card data |
Most small and mid-sized online stores do well with an integrated plugin for their cart. Subscription platforms and businesses with custom software often use the API for control over billing logic. Professional services firms that take payments by phone or invoice often depend on the gateway's virtual terminal, a secure browser screen for keying in card details. You can compare virtual terminal options for keyed and phone payments if that describes most of your volume.
PCI DSS validation requirements depend on how your integration handles card data. Ask your provider which validation applies to your setup before you go live.
Key Gateway Features: Tokenization, Fraud Filters, Recurring Billing
Most gateways can process a payment. They differ in what they do around that payment.
Tokenization and Customer Vaults
Tokenization replaces the card number with a random token. You store the token instead of the card. When a customer saves a card for faster checkout, or you bill a member every month, you charge the token.
There are two layers worth knowing:
- Gateway tokens are created and stored by your gateway. They are convenient, but they can tie you to that gateway unless it lets you export card data to a new provider in a secure, compliant way.
- Network tokens are issued through the card networks and can update automatically when a customer's card is reissued. Our article on network tokenization and fewer failed renewals explains how they work.
Fraud Filters
Card-not-present payments carry more fraud risk than in-person payments, so gateway fraud tools matter. Common controls include:
- AVS and CVV rules that decline or flag mismatches
- Velocity limits on how many attempts one card, IP address or email can make
- Country, IP and order-amount filters
- 3D Secure authentication, which can shift liability for certain fraud chargebacks to the issuer
Settings that are too strict reject good customers. Settings that are too loose invite chargebacks. Our guide to AVS and CVV mismatch settings for online stores explains how to strike that balance. MannyPay also supports 3D Secure authentication for online merchants.
Recurring Billing
Subscription boxes, gyms, software tools and monthly retainers all depend on recurring billing. Look for:
- Flexible schedules (weekly, monthly, annual, custom)
- Free trials and prorated changes
- Automatic retries for failed payments
- Customer notifications and easy cancellation workflows
Failed renewals are a quiet source of lost revenue. Pair your gateway's retry logic with a plan for recovering failed subscription payments. Also check your obligations under state automatic renewal laws.
Other Features Worth Checking
- Virtual terminal for phone, mail and keyed orders
- Reporting and exports, ideally with an accounting integration such as QuickBooks
- ACH or eCheck acceptance, if your customers prefer bank payments
- Multi-currency support, if you sell internationally
Payment Gateway Fees: Setup, Monthly, and Per-Transaction
Gateway pricing varies by provider and by how the gateway is bundled. Treat the categories below as a checklist, not a quote, and get current terms in writing.
| Fee Type | What It Covers | Questions to Ask |
|---|---|---|
| Setup fee | Account creation and configuration | Is it waived? Is it refundable? |
| Monthly fee | Access to the gateway and its standard features | What's included vs. add-on? |
| Per-transaction fee | A small charge each time the gateway handles a request | Are declines, refunds and voids charged too? |
| Add-on fees | Customer vault, advanced fraud tools, recurring billing, ACH | Which add-ons will I actually need? |
Gateway fees are separate from card-processing costs. Processing costs, which include interchange, network fees and your provider's markup, usually make up the larger share of what you pay. Online and keyed payments typically cost more to process than in-person payments because of the higher fraud risk. Our explainer on why online and keyed transactions cost more to process covers the reasons.
When you compare offers, add up the gateway fees and processing costs together for a typical month. A low gateway fee next to expensive processing, or the reverse, can mislead you.
Do You Need a Separate Gateway or Is It Bundled?
It depends on how you accept payments today.
Bundled (all-in-one): Many payment aggregators and some ecommerce platforms combine the gateway, processing and account into one package. Setup is fast. The tradeoffs can include less control over pricing, shared-account risk policies and stored card data that is harder to move. See merchant accounts vs. payment aggregators for a side-by-side comparison.
Merchant account plus standalone gateway: You have a dedicated merchant account and connect a gateway such as Authorize.Net or NMI. This setup usually means a fuller underwriting review. In return, it often gives you more flexibility: you can change processors without rebuilding your checkout, and your card vault can stay in place.
Some hosted store platforms have a built-in payment option and may apply their own terms or fees when you use an outside provider. Check your platform plan before you switch.
Choosing an Ecommerce Payment Gateway That Fits Your Shopping Cart
Use this checklist when you evaluate an online payment gateway:
- Cart compatibility. Does it have a maintained plugin for your platform, such as Shopify, WooCommerce, BigCommerce or Magento? A full list is on the MannyPay integrations page.
- Processor compatibility. Does it work with the merchant account you have or plan to open?
- Billing model. Does it handle one-time sales, authorize-and-capture for shipped orders, recurring billing, or all three?
- Keyed payments. If you take phone orders or invoice clients, is the virtual terminal easy for staff to use?
- Fraud controls. Can you adjust AVS, CVV, velocity and 3D Secure settings yourself?
- Token portability. If you leave, can your stored cards move with you securely?
- PCI DSS scope. Which integration method keeps card data off your servers?
- Reporting. Can you reconcile deposits easily and export to your accounting software?
- Total cost. What are the gateway fees and processing costs combined for a typical month?
How these priorities shift by business type:
- E-commerce stores: Plugin quality, checkout speed, fraud filters and authorize-then-capture for shipped goods matter most.
- Subscriptions and memberships: Recurring billing tools, network tokenization, retry logic and vault portability come first.
- Professional services: A clean virtual terminal, stored payment profiles for repeat clients and invoice-friendly workflows usually decide it.
Next Steps
A payment gateway is a small part of your payment stack, but nearly every online, keyed and recurring transaction depends on it. Start by mapping how you take payments today: which shopping cart you use, how much of your volume is keyed and whether you bill on a recurring schedule. Then compare gateway features and total costs against that picture. Our guide on how to choose a payment gateway provider for your business walks through that comparison.
MannyPay offers payment gateway options that connect with major shopping carts and accounting tools, along with online payment processing for e-commerce, subscription and service businesses. To discuss your setup, request a free quote. A MannyPay specialist will respond within one business day.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
