What Is a Payment Gateway and What Does It Do?
A payment gateway is the technology layer that connects a merchant checkout to the payment ecosystem. It receives the transaction request, formats it, applies routing or risk logic, and sends it to the right processor or payment service provider.
For merchants, the gateway is often the most visible part of payment infrastructure because it sits close to the checkout experience. Companies such as Stripe, PayPal, Braintree, and Adyen made it much easier for businesses to start accepting online payments without building direct processor integrations from scratch.
Why Payment Gateways Exist
Before modern gateways became common, accepting cards online required a business to source merchant credentials, go through underwriting, establish direct processor connectivity, manage PCI compliance independently, and hire technical teams who understood authorization, settlement, reporting, and fraud controls. The operational and technical barrier was high.
Payment gateways simplified that work by consolidating the integration layer. A single gateway connection gives merchants access to processors, fraud tools, tokenization, reporting, and increasingly, multiple payment methods — all through one API or hosted interface.
How Authorization Actually Works
When a customer submits payment at checkout, the gateway orchestrates the following sequence:
- Transaction capture: The gateway receives encrypted card data from the checkout page or app — via hosted fields, a redirect, or a direct API call.
- Routing: The gateway applies routing rules to select the right processor based on card type, geography, currency, or business logic.
- Authorization request: The processor sends an authorization message to the card network (Visa, Mastercard), which routes it to the card issuer.
- Issuer decision: The issuing bank approves or declines based on available funds, fraud scoring, and risk controls.
- Response: The authorization response travels back through the network to the processor, to the gateway, and finally to the merchant checkout — typically in under two seconds.
The gateway handles encryption, tokenization, and response formatting throughout this flow. It is also the point where 3D Secure authentication is triggered when required.
What a Payment Gateway Does
- Connects the checkout page or app to processors and payment service providers.
- Packages transaction data and sends authorization requests to the right downstream provider.
- Supports payment methods such as cards, digital wallets, and sometimes bank payments.
- Reduces PCI scope via tokenization, hosted fields, or secure payment forms.
- Routes transactions based on provider, geography, card type, currency, or business rules.
- Triggers and manages 3D Secure (3DS2) authentication flows.
- Connects to fraud-prevention tools and risk decisioning services.
- Supports capture, settlement, refunds, voids, and reporting workflows.
Integration Types
Hosted fields (iFrame): Card data is entered directly into fields hosted by the gateway, not the merchant server. PCI scope is significantly reduced because raw card data never touches merchant infrastructure. Most modern gateways offer this.
Redirect: The customer is sent to a hosted payment page on the gateway domain to complete checkout. Simple to implement but offers less control over the payment UX. Common with PayPal Checkout and similar flows.
Direct API: The merchant collects card data on their own checkout page and sends it server-side to the gateway. Maximum flexibility, but also the highest PCI compliance burden — typically requiring SAQ D or a full PCI DSS assessment.
Most product teams choose hosted fields or redirect for web checkout and use direct API only where UX requirements justify the compliance overhead.
Gateway vs. Processor
A gateway is not the same thing as a processor. The gateway is the orchestration and integration layer — it handles routing, tokenization, fraud screening, and the developer-facing API. The processor handles the deeper transaction-processing rails: authorization messages, clearing, and settlement with card networks.
Some providers offer both capabilities in one platform (Stripe, Adyen, Worldpay), which is why the terms get confused. Others are gateways only, relying on separate processors underneath. Understanding which layer a provider operates at matters when evaluating authorization rates, pricing, and portability.
To understand where a gateway fits in the wider flow, see the main players in payment processing.
3D Secure and Authentication
Modern gateways are responsible for triggering 3D Secure (3DS2) authentication when required by regulation or issuer preference. In markets with Strong Customer Authentication mandates — the EU under PSD2, the UK — the gateway must support 3DS2 flows and correctly handle exemptions for low-value transactions, merchant-initiated transactions, and trusted beneficiaries.
A gateway that handles 3DS poorly — triggering it unnecessarily or failing to pass the right data — can meaningfully hurt authorization rates. Evaluating 3DS implementation quality is an important part of gateway selection for any business selling in regulated markets.
Tokenization
Gateways store a token — a surrogate value — in place of the actual card number. This allows merchants to process repeat transactions, subscription billing, and one-click checkout without storing raw PAN data. It is the primary mechanism for reducing PCI compliance scope on the merchant side.
Network tokenization goes a step further, replacing the PAN with a token issued at the card network level. This improves authorization rates and reduces card-not-present fraud. Many gateways now support network tokenization as a built-in feature. See why merchants should adopt network tokenization for a deeper look.
Settlement
Authorization and settlement are two distinct steps. Authorization reserves funds; settlement moves them. Most card transactions settle in T+1 or T+2 — one to two business days after the transaction date.
The gateway manages the capture step that initiates settlement. For pay-at-checkout transactions, capture often happens automatically at authorization. For businesses that ship physical goods, deferred capture is common — authorizing at order and capturing when the item ships. Understanding payment processing fees matters here too — interchange and assessments are calculated on settled transactions.
Why It Matters
The right gateway improves authorization performance, reduces integration effort, lowers operational friction, and makes it easier to add new payment methods. The wrong setup creates duplicated logic, poor reporting, failed retries, and unnecessary payment costs.
For a payments product team, the gateway is more than a connector. It is a control point for checkout reliability, transaction routing, fraud integration, tokenization, and customer payment experience. Choosing, configuring, and monitoring the gateway is core payments product work.
Frequently Asked Questions
Is Stripe a payment gateway or a payment processor?
Stripe is both. It operates as a gateway (developer API, hosted fields, routing) and as a processor (it has its own acquiring relationships). This is what makes it a full-stack payment platform.
Do I need both a gateway and a processor?
If you use a full-stack provider like Stripe or Adyen, both functions are bundled. If you use a gateway-only provider, you need a separate acquiring relationship with a processor. Many enterprise merchants use a gateway to route across multiple processors to maximize authorization rates.
Can a gateway affect my authorization rate?
Yes, significantly. Routing logic, 3DS handling, network token support, and data quality all affect how issuers score and respond to transactions. Gateway selection and configuration is one of the highest-leverage levers for improving payment performance.
What is the difference between a payment gateway and a payment facilitator?
A payment gateway is a technology layer for routing and processing. A payment facilitator (PayFac) is a business model where a company onboards sub-merchants under its own master merchant agreement. Many PayFacs use a gateway as part of their infrastructure. See what is a payment facilitator for more.