Gateway Basics
- A gateway connects your website to a processor. It handles data transmission and tokenization, but it doesn't move money - that's the acquirer's job
- Most modern processors (Stripe, Square, Shopify Payments) bundle gateway + processing; standalone gateways (Authorize.net, NMI) are only needed when you want to route to multiple processors
- Using a hosted gateway (iframe/redirect) takes card data off your server and dramatically reduces PCI scope - this is the right choice for most businesses
- Gateway fees ($0.05-$0.30 per transaction) are separate from processing fees when using standalone gateways; bundle solutions hide both in a single rate
A gateway connects your website to a processor. It doesn't move money. If your "processor" has a JavaScript snippet you embed on checkout, that's the gateway part.
Gateway vs. Processor vs. Acquirer
These three get confused constantly, and the difference decides who you call when something breaks.
| Component | What It Does | Handles Money? |
|---|---|---|
| Gateway | Securely transmits payment data to processor | No |
| Processor | Routes transactions, communicates with networks | No (facilitates) |
| Acquirer | Holds your merchant account, settles funds | Yes |
Analogy
- Gateway = The secure mailroom that receives packages and sends them to the right office
- Processor = The logistics company that routes packages between locations
- Acquirer = The bank that actually holds and deposits your money
What Gateways Actually Do
Core Functions
| Function | What It Means |
|---|---|
| Secure data capture | Collects card numbers without touching your servers (PCI scope reduction) |
| Encryption | Encrypts card data for transmission |
| Tokenization | Replaces card numbers with tokens for storage |
| API interface | Provides developer-friendly APIs for integration |
| Transaction routing | Sends transactions to the right processor |
Common Features
| Feature | What It Does |
|---|---|
| Hosted checkout | Pre-built checkout pages you redirect to |
| Embedded forms | JavaScript forms that run on your site |
| Mobile SDKs | Native iOS/Android payment integration |
| Webhooks | Notifications when transactions complete |
| Dashboard | Transaction reporting and management |
| Fraud tools | Basic fraud screening (rules, velocity) |
When You Need a Separate Gateway
You Don't Need a Separate Gateway When:
You use a PayFac like Stripe, Square, or PayPal
These combine gateway + processor + acquirer into one service:
- Stripe = Gateway + Processor + Acquirer relationship
- Square = Gateway + Processor + Acquirer relationship
- PayPal = Gateway + Processor + Acquirer relationship
You sign up, integrate their JavaScript, and you're processing. One contract, one dashboard.
You Need a Separate Gateway When:
| Scenario | Why |
|---|---|
| Multi-processor strategy | Gateway routes to different processors for failover or optimization |
| Existing acquirer relationship | You have a merchant account but need modern APIs |
| Processor doesn't have good APIs | Legacy processor with outdated integration |
| Custom integration needs | Specific features not available from PayFacs |
| International routing | Need to route to local acquirers in different countries |
Gateway-Only vs. Full-Stack
| Type | What You Get | Examples |
|---|---|---|
| Gateway-only | Just the secure transmission layer. You need a separate processor/acquirer. | Authorize.net, NMI, PayPal Payflow |
| Full-stack | Gateway + Processor + Acquirer bundled. All-in-one. | Stripe, Square, Adyen, Braintree |
Trade-offs
| Factor | Gateway-Only | Full-Stack |
|---|---|---|
| Complexity | Higher (multiple vendors) | Lower (one vendor) |
| Flexibility | Higher (choose processor) | Lower (locked in) |
| Pricing | Potentially lower (negotiate each layer) | Fixed or bundled |
| Support | Multiple contacts | Single contact |
| Switching | Can switch processor, keep gateway | Switching is all-or-nothing |
Common Gateway Configurations
Configuration 1: All-in-One (Most Common)
You → Stripe (Gateway + Processor + Acquirer relationship)
Best for: Most SMBs. Simple, fast to start, good enough pricing.
Configuration 2: Gateway + Processor
You → Authorize.net (Gateway) → First Data (Processor/Acquirer)
Best for: Existing processor relationship with outdated APIs.
Configuration 3: Multi-Processor Through Gateway
You → Spreedly (Gateway) → Processor A (primary)
→ Processor B (failover)
→ Processor C (international)
Best for: High-volume merchants needing redundancy or routing optimization.
Configuration 4: Payment Orchestration
You → Primer/Spreedly → Multiple processors + payment methods
→ Routing rules
→ Failover
→ Analytics
Best for: Complex needs, multiple markets, high volume.
Popular Gateways Compared
Full-Stack (Gateway + Processor)
All rates below verified against each vendor's own pricing page on 2026-08-02.
| Gateway | Best For | Published rate | Notes |
|---|---|---|---|
| Stripe | Most online businesses | 2.9% + 30c domestic; Terminal 2.7% + 5c card-present | Best APIs, good global coverage. Adds +1.5% on international cards, higher than Braintree's +1% |
| Square | Retail + online hybrid | 2.6% + 15c card-present (Free plan); 3.3% + 30c online (Free), 2.9% + 30c (Plus and Premium) | Strong POS, simpler than Stripe. The fixed component is 15c, not the 10c widely quoted |
| Braintree | PayPal integration | 2.89% + $0.29 cards and digital wallets | Owned by PayPal, good for marketplaces. Same price as Stripe within a penny |
| Adyen | Enterprise, global | Not published. Interchange++ plus a $0.13 processing fee | No monthly fee, but an unquantified "minimum invoice". No $10M volume floor exists |
| Checkout.com | Mid-market to enterprise | Not published. Flat-rate or Interchange++, quote only | Strong in Europe |
Gateway-Only
| Gateway | Best For | Notes |
|---|---|---|
| Authorize.net | Legacy integration | Widely supported, older technology |
| NMI | ISOs and resellers | White-label friendly |
| PayPal Payflow | PayPal + other processors | Connects to various processors |
Payment Orchestration
| Platform | Best For | Notes |
|---|---|---|
| Spreedly | Multi-processor routing | Vault + routing + analytics |
| Primer | Modern orchestration | Visual workflow builder |
| Payrails | Global optimization | Routing optimization focus |
Gateway Fees
What gateways charge varies by model:
Full-Stack Pricing
Typically bundled. Published US figures, verified 2026-08-02:
- Per-transaction: Braintree 2.89% + $0.29; Square 3.3% + 30c online on the Free plan, 2.6% + 15c in person; PayPal Checkout 3.49% + $0.49
- Cross-border: Braintree +1% for cards issued outside the US and a further +1% for non-USD; PayPal +1.50% international; Stripe +0.8% international cards and +2% currency conversion
- Monthly fee: $0 on Braintree (not published), Square Free and Stripe. Stripe states it "does not charge setup fees, monthly fees, or any other hidden fees"
Gateway-Only Pricing
Separate from processor fees. Authorize.net, NMI and PayPal Payflow don't publish comparable rate cards this site could verify on 2026-08-02. Treat the ranges below as planning placeholders, and get a written quote:
- Per-transaction: typically $0.05-$0.15
- Monthly fee: typically $10-$50
- Setup fee: $0-$200
Total cost = Gateway fee + Processor fee + Interchange
Integration Considerations
PCI Scope Reduction
Gateways reduce your PCI compliance burden by handling card data:
| Integration Type | Card Data Touches Your Server? | PCI Level |
|---|---|---|
| Redirect to hosted page | No | SAQ A (simplest) |
| Embedded iframe | No | SAQ A-EP |
| JavaScript tokenization | No | SAQ A-EP |
| Direct API (cards) | Yes | SAQ D (hardest) |
Recommendation: Use embedded forms or hosted pages, unless you've got a specific reason to handle cards directly.
API Quality Matters
Gateway API quality varies dramatically:
| Factor | Good Gateway | Poor Gateway |
|---|---|---|
| Documentation | Clear, complete, examples | Sparse, outdated |
| SDKs | Multiple languages, maintained | Limited, stale |
| Sandbox | Full-featured test environment | Limited or broken |
| Webhooks | Reliable, retries, logging | Unreliable, no retries |
| Error messages | Specific, tells you what to fix | Generic, unhelpful |
Switching Gateways
What breaks when you switch:
| Element | Impact |
|---|---|
| Tokens | Old tokens don't work with new gateway |
| Saved cards | Must re-collect or migrate |
| Integration code | Needs rewriting |
| Webhooks | Different format/structure |
| Reporting | Different dashboard/exports |
Mitigation: Some orchestration layers (Spreedly) can vault tokens and abstract gateway changes.
Test to Run
Gateway evaluation checklist:
□ Do they support your current processor (if keeping it)?
□ API documentation quality - can a dev understand it?
□ Sandbox available and functional?
□ What's their uptime SLA?
□ Webhook reliability and retry logic?
□ What happens to tokens if you switch away?
□ Support quality (test with pre-sales question)
□ Pricing for your volume and average ticket?
Scale Callout
| Volume | Recommendation |
|---|---|
| Under $100k/mo | Full-stack (Stripe, Square). Don't overcomplicate. |
| $100k-$500k/mo | Still fine with full-stack. Evaluate if specific needs arise. |
| $500k-$2M/mo | Consider if multi-processor or custom routing would help. |
| Over $2M/mo | Evaluate orchestration. Multi-processor redundancy matters. |
Where This Breaks
-
Token portability. Tokens from one gateway don't work at another. Switching means re-collecting cards or complex migration.
-
Feature assumptions. Not every gateway supports every feature, and the gaps aren't obvious until you hit one. Check partial captures, auth holds, 3DS2 and network tokens.
-
International support. "Global coverage" varies. Check specific countries and payment methods you need.
-
Downtime cascades. If your full-stack provider goes down, you can't process. Multi-processor setups need orchestration to failover.
Next Steps
Just starting out? Pick a full-stack provider and integrate their embedded form. See Buying Payments. Don't overthink it, because you can switch later.
Evaluating gateways? Write down the features, countries and payment methods you actually need. Then test the sandbox before you commit to anything. Check the pricing at your volume too, since it varies a lot.
Already have one? Map your stack against the Payment Ecosystem. If your volume or your markets have changed, orchestration may now be worth it.
See Also
- Payment Ecosystem - How all the pieces fit
- Provider Types - Gateway vs ISO vs PayFac
- Buying Payments - Choosing a processor
- Processor Comparison - Comparing options
- PCI DSS Compliance - PCI scope and gateways
- Authorization & Capture - Transaction mechanics
- Processor Switch Checklist - Switching playbook