Payment Gateway

A payment gateway receives payment data from the merchant's checkout, via API call, hosted payment page, or SDK, encrypts it, and routes it to the appropriate processor or acquirer for authorisation. It is the entry point of the transaction, responsible for data security and message formatting before the request reaches the acquiring system.

There are two main integration models. A hosted payment page is served directly by the gateway provider; the cardholder enters card data on the gateway's domain, which removes the merchant from PCI scope for card data entry and enables SAQ A self-assessment. A direct API integration gives the merchant full control over checkout UX but requires handling raw card data, significantly expanding PCI obligations.

On receiving a transaction, the gateway validates the request format, applies any pre-authorisation checks configured by the merchant (fraud rules, velocity checks, 3DS triggers), then routes the authorisation request to the acquirer. It receives the authorisation response and returns it to the merchant's system, typically within 1-3 seconds.

The gateway also handles post-authorisation events: captures, voids, and refunds. Many modern gateways additionally support multi-acquirer routing, network tokenisation, and stored credential management, capabilities that increasingly overlap with payment orchestration.

PCI scope is determined by integration model: merchants using a hosted payment page can qualify for SAQ A, the simplest self-assessment. Merchants using API-direct integrations handle raw card data and face significantly broader PCI requirements and audit scope.

Gateway uptime is checkout uptime: a gateway outage stops transactions. Enterprise merchants should verify their gateway provider's SLA, failover architecture, and published uptime record before committing.

Gateway lock-in carries real commercial risk: switching gateways requires re-certification, re-testing, and potential loss of stored payment credentials unless the gateway supports token portability to a portable vault.

Feature gaps compound at scale: not all gateways support multi-currency pricing, network tokenisation, or advanced retry logic. Gaps that are acceptable at low volume become blockers as merchants expand into new markets.