Gateway Payment Guide: How Payment Gateways Work

A gateway payment is the secure handoff that begins when a customer chooses how to pay and ends when the merchant receives a reliable approval, decline, or pending result. The gateway collects or presents payment details, sends the request to the appropriate provider, and returns the provider’s response to the checkout. It does not necessarily move or hold the money itself.

For an online business, the practical goal is simple: give customers eligible ways to pay without forcing the merchant’s application to handle sensitive payment credentials or provider-specific complexity. A well-designed gateway payment setup can connect cards, digital wallets, bank methods, and crypto to one order workflow while keeping the responsibilities of the gateway, processor, provider, and merchant clear.

This guide explains the full flow, the main gateway models, security responsibilities, pricing questions, and an implementation checklist. It also shows how Paymegate’s payment gateway uses hosted checkout and independent providers while keeping order creation, status, and supported crypto settlement in one merchant workflow.

What is a payment gateway?

A payment gateway is a software layer that passes payment instructions between a merchant’s checkout and the financial or blockchain infrastructure that can act on them. In a card transaction, that normally means sending an authorization request toward a processor or acquirer and returning the issuer’s response. In a crypto transaction, it can mean presenting an address and exact amount, monitoring the relevant network, and updating the order after sufficient confirmation.

The word “gateway” describes a role, not a universal product bundle. One company may offer only the gateway interface. Another may bundle gateway, processing, acquiring, fraud tools, and merchant settlement under one contract. A payment-orchestration platform may connect one merchant workflow to several independent providers.

That distinction matters when comparing services. A feature shown in a checkout does not prove that the gateway itself processes the transaction, holds funds, or licenses every underlying payment rail. Read the provider agreement and product terms, not just the list of logos.

Paymegate is payment-orchestration software. It creates orders, displays methods that are eligible for a particular checkout, tracks provider or blockchain confirmation, and supports settlement to merchant-configured wallets. It is not a bank, money transmitter, payment institution, acquirer, or direct payment processor. Actual payment processing is performed by independent third-party providers, as explained in the Paymegate Terms of Use.

How a gateway payment works

Although the participants vary by method, a robust gateway payment flow has the same basic shape: create an order, determine eligible methods, collect the customer’s choice, send the payment request, verify the result, and reconcile the merchant’s order.

The merchant creates an order

The order should be created on a trusted server, not assembled only in the browser. It normally includes an amount, currency, return URL, and a merchant reference such as an invoice ID. The gateway returns a checkout URL or session identifier.

Keeping this step server-side protects the merchant credential and gives the merchant a durable record before payment begins. With Paymegate, creating an order produces an unpaid order and a platform-owned checkout URL. It does not mean a transaction has occurred, and it does not by itself prove payment.

The gateway determines which methods are eligible

Not every payment method is available for every order. Availability can depend on the merchant configuration, buyer or merchant country, currency, amount, provider status, network support, and provider eligibility rules.

A trustworthy checkout should show only methods that can actually be attempted for that order. Paymegate applies this context when presenting eligible card, bank, wallet, and crypto methods. No individual method is guaranteed worldwide; the Paymegate FAQ explains these availability limits.

The customer chooses a payment method

For cards, digital wallets, or bank methods, a hosted gateway can redirect the customer to an independent provider’s payment page. The provider then collects the required details and controls any customer verification or authentication step.

For direct crypto checkout, the experience is different. The customer sees the selected asset, network, amount, receiving address, QR code, and quote expiry. The customer must use the correct asset and network. Sending a different token or choosing the wrong network can prevent recovery.

The provider or network evaluates the payment

In a card flow, the provider sends the authorization through the relevant payment chain. The issuer ultimately decides whether to approve or decline. A gateway can pass useful transaction context and present the result, but it cannot guarantee approval.

In a crypto flow, the system monitors the transaction on the selected blockchain. The payment remains pending until the required conditions are met. Confirmation time depends on the network, congestion, provider behavior, and the customer’s actions, so a merchant should not promise a universal completion time.

The merchant verifies the final status

The browser redirect is useful for customer experience, but it should not be the merchant’s source of truth. Customers can close a tab, lose connectivity, or manipulate a client-side request. A merchant integration should verify a signed server-to-server event or query the trusted order API before fulfilling the purchase.

Paymegate sends a signed payment webhook after a verified payment event. Its commerce plugins use authenticated, replay-safe callbacks to map the paid result back to the original store order. Developers can review the order and webhook contract in the Merchant API documentation.

Settlement follows the applicable route

Authorization, payment confirmation, and settlement are related but different events. A card authorization can succeed before funds are finally settled. Provider-funded payment methods can also remain subject to provider-specific disputes or refunds.

For supported Paymegate flows, settlement is initiated to a compatible wallet configured by the merchant after confirmation. The asset, network, provider outcome, and actual timing depend on the order. Paymegate is designed not to custody merchant funds, but an independent provider or network still controls its part of the process.

Payment gateway vs payment processor vs merchant account

These terms are often used interchangeably in marketing, but they represent different jobs.

Payment gateway

The gateway provides the checkout-facing software and routes a payment request to the appropriate destination. It may also create sessions, filter available methods, display status, and send webhooks. A gateway can be sold separately or bundled with other services.

Payment processor or payment provider

The processor or provider performs the operational work required by the selected rail. In card payments, that can include passing authorization messages between the acquirer, network, and issuer. Providers may also manage fraud controls, customer verification, currency conversion, disputes, or payouts under their own terms.

Acquirer and merchant account

An acquirer enables a merchant to accept card payments and participates in settlement. A traditional merchant account is an account used within that acquiring relationship. Some all-in-one providers abstract this structure from the merchant, but the underlying responsibilities still exist.

Issuer and payment network

The issuer is the institution that issued the customer’s card or account. It decides whether to approve the authorization based on its rules and available information. The card network carries messages between participating institutions; it is not the same thing as the gateway.

The most useful buying question is not “Which label does this company use?” It is “Which party owns each responsibility?” Ask who collects credentials, who authorizes, who handles disputes, who settles funds, who stores data, and who provides support when something fails.

The main types of payment gateway

The right gateway model depends on how much checkout control the merchant needs and how much payment-security responsibility it can operate safely.

Hosted checkout

A hosted checkout sends the customer to a payment page controlled by the gateway or connected provider. It is usually the fastest way to launch because the merchant does not build the sensitive payment form.

Benefits include:

• Less payment-page code inside the merchant application
• A consistent flow across payment links, plugins, and custom integrations
• Provider-controlled authentication and payment-data collection
• Easier updates when a provider changes its requirements

The trade-offs are a redirect or hosted-page transition, less control over some interface details, and continued responsibility for protecting the merchant website and redirect mechanism.

Embedded or direct integration

An embedded form can keep the customer visually inside the merchant’s checkout. This may offer more design control, but the implementation and security scope depend on where the fields originate, where data is sent, and which scripts can affect the payment page.

Do not assume that using an iframe, JavaScript SDK, or token automatically removes PCI DSS responsibilities. Confirm the specific integration design with the acquirer, payment brand, or qualified compliance adviser.

Payment links

A payment link creates a shareable hosted checkout for an order. It is useful for invoices, customer support, social selling, and businesses without a full ecommerce site. The merchant should still reconcile the paid event to an invoice or internal reference and avoid fulfilling from a screenshot or browser return alone.

Paymegate merchants can create payment links from the dashboard or create orders through the API.

Ecommerce plugins

A plugin connects a commerce platform’s order model to a hosted gateway. A production plugin should create the order server-side, protect the API key, verify signed callbacks, prevent duplicate settlement, and map payment states predictably.

Paymegate provides documented integrations for WooCommerce, WHMCS, PrestaShop, and OpenCart. Their compatibility requirements and installation steps are listed on the payment plugins page.

Crypto payment gateway

A crypto gateway presents network-specific payment instructions and watches for on-chain confirmation. Important capabilities include exact-amount quotes, unique addresses where supported, QR codes, expiry handling, confirmation checks, and forwarding to a compatible merchant wallet.

Paymegate’s crypto payment gateway supports several network families, including Bitcoin, Ethereum, BNB Smart Chain, Arbitrum, Avalanche, Solana, and TRON. Available assets are filtered by platform support and the wallet networks configured by the merchant.

Security and compliance responsibilities

No gateway makes security or compliance disappear. It changes where data flows and how responsibilities are shared.

PCI DSS still matters with outsourced checkout

The PCI Security Standards Council states that PCI DSS still applies when a merchant outsources all payment processing, although many requirements may not apply directly to the merchant’s own environment. The merchant remains responsible for confirming the provider’s compliance, documenting shared responsibilities, and completing the validation required by its compliance-accepting entity. See the Council’s official guidance on outsourced payment processing and PCI DSS.

Hosted checkout can reduce scope, but the merchant website still needs secure administration, timely patching, access controls, and protection against a malicious change that redirects customers to a fake payment page.

Tokenization is not the same as encryption

Encryption protects data by transforming it with a cryptographic key. Tokenization replaces a sensitive value with an alternative value whose usefulness is limited outside its intended context.

EMVCo explains that EMV Payment Tokenisation replaces a primary account number with a payment token that can be constrained to a merchant, device, or payment scenario. That reduces the value of compromised payment data; it does not make every token or every integration risk-free. Read the official EMV Payment Tokenisation overview.

Authentication helps but does not guarantee approval

EMV 3-D Secure supports data exchange between a merchant and issuer to authenticate a consumer in a card-not-present transaction. It is one security tool, not a promise that a transaction will be approved or immune from disputes. EMVCo’s 3-D Secure overview describes its role in ecommerce authentication.

Merchant keys and webhooks need careful handling

A safe integration should:

• Keep live API keys on the server and out of browser code
• Give keys only the scopes required for their task
• Verify webhook signatures before changing an order
• Use idempotent processing so a repeated event does not fulfill twice
• Compare the paid order’s identifier, amount, and currency with the merchant record
• Log failures without exposing credentials or private provider data
• Rotate a key immediately if it may have been disclosed

Paymegate supports scoped live and test keys. Test keys are for integration work and cannot create live payments or read live payment data.

Crypto settlement adds operational risk

Blockchain transactions are generally not reversible through a chargeback mechanism. The merchant is responsible for supplying an accurate, compatible wallet address and for protecting the wallet’s keys or recovery material. Paymegate’s terms state that payouts sent to an incorrect or non-self-custodial address cannot be recovered.

Merchants should test every configured network with a low-value order, confirm who controls the destination wallet, and document a refund process. They must also follow the laws and restrictions applicable to their business. Payment orchestration does not remove sanctions, tax, consumer-protection, licensing, or acceptable-use obligations.

What does a gateway payment cost?

Gateway pricing should be evaluated as a complete stack, not as a single headline percentage. Depending on the method and provider, costs may include:

• A gateway or platform fee
• An independent provider fee
• A blockchain network fee
• Currency conversion or exchange costs
• Provider-specific dispute or refund fees
• Monthly, setup, minimum, or volume commitments

Ask for an example using your usual order amount, customer country, currency, and payment method. Then calculate the net amount you expect to receive. A low gateway fee can be offset by an unfavorable provider fee or conversion rate, while a higher headline fee may include services that reduce operational work.

Paymegate’s published pricing starts at a 1% platform fee. Card-gateway orders add the applicable independent-provider fee; crypto orders add the applicable network fee. The pricing page states there are no monthly fees, setup costs, or rolling reserves charged by Paymegate. Minimum order amounts range from $1 to $30 depending on the selected provider. Because provider and network fees are outside Paymegate’s control, merchants should check the final eligible methods and costs for their actual order mix. See the current Paymegate pricing before making a commercial decision.

How to choose a gateway payment solution

Start with the customer journey and work backward. A gateway with a long feature list is not useful if it cannot support the customer’s country, currency, order size, or preferred method.

Confirm method availability, not just advertised coverage

Ask which methods are available for your merchant category and target markets. Check whether eligibility is evaluated per order and how the checkout behaves when a provider is unavailable. Treat “global” as a question to investigate, not a guarantee.

Map every party and responsibility

Identify the gateway, processor or provider, acquirer where relevant, settlement destination, and support owner. Read the terms for each independent provider. Confirm who handles customer verification, fraud decisions, refunds, disputes, and service interruptions.

Compare the full cost

Model several representative transactions rather than comparing only platform percentages. Include provider, network, and conversion costs. Review minimum order values and whether the fee changes by merchant volume or method.

Choose an integration your team can operate

Payment links or a maintained commerce plugin suit teams that want a short implementation path. An API is more flexible but requires secure credential storage, webhook handling, retries, logging, and operational monitoring.

Paymegate offers payment links, four commerce plugins, and a server-to-server API. The API reference documents order creation, method discovery, wallet configuration, and webhook settings.

Test failure states before launch

Successful payments are only one path. Test:

• An approval and a decline
• A customer abandoning checkout
• An expired crypto quote
• A delayed or repeated webhook
• A payment method becoming unavailable
• A mismatched amount or currency
• A return-page visit before server confirmation
• A support workflow for a disputed or mistaken payment

The merchant’s order should remain unpaid until the trusted verification path succeeds. Fulfillment should be idempotent so retries cannot create duplicate delivery.

A practical Paymegate integration path

Paymegate keeps the merchant-facing flow consistent across links, plugins, and the API.

Create and configure the merchant account

Provide the basic account and business information requested by Paymegate and configure compatible payout wallets for the networks you intend to use. Paymegate merchant signup does not request identity or business-document uploads. That is narrower and more accurate than saying “no KYC”: independent providers may still apply customer verification, eligibility, geographic, fraud, sanctions, transaction, or compliance checks.

Select an integration

Use a payment link for a quick hosted flow, install a supported plugin for an ecommerce platform, or use the API for a custom application. A custom integration should create orders on the server and share only the returned Paymegate checkout URL with the customer.

Configure settlement carefully

Crypto assets are offered only when Paymegate supports the asset and both the platform and merchant have a compatible wallet for its network. Confirm the network family and wallet ownership before enabling it. Never paste a wallet address without independently checking it.

Reconcile through signed events

Store your own external order reference when creating the Paymegate order. Verify the signed webhook, match the order, amount, and currency, then update fulfillment once. Use the dashboard and API status for investigation rather than treating a customer screenshot as evidence of payment.

Keep provider limitations visible

The provider controls processing outcomes, verification, method eligibility, and parts of the settlement timing. Paymegate controls its software workflow but cannot guarantee that a provider will approve a specific customer or transaction.

Gateway payment questions merchants often ask

Does a gateway hold the merchant’s money?

Not necessarily. A gateway can route instructions without holding funds. Always verify the contractual flow for the specific service. Paymegate provides software services and is designed not to custody merchant funds; supported settlement is initiated to a merchant-configured wallet after confirmation.

Is a gateway the same as a payment processor?

No. The gateway is the software entry and routing layer; a processor or provider performs the underlying payment operation. Some vendors bundle both roles, which is why the contract matters more than the product label.

Does hosted checkout eliminate PCI DSS?

No. Outsourcing can reduce the requirements that apply directly to the merchant environment, but the PCI Security Standards Council says the merchant retains responsibilities. Confirm the correct validation path with the entity that accepts your compliance.

Can one gateway support cards and crypto?

Yes, if its connected providers and technical design support both. The authorization and settlement mechanics differ, so the merchant should understand each path. Paymegate offers eligible cards, wallets, bank methods, and crypto within one order workflow, with supported crypto settlement to configured wallets.

Is crypto payment final immediately?

No universal timing applies. A crypto payment must be detected and meet the required confirmation conditions. Timing varies by blockchain, network conditions, provider behavior, and customer action.

Can a merchant skip verification requirements?

Do not assume so. Paymegate’s own merchant signup does not request identity or business-document uploads, but independent providers can apply customer verification and other eligibility or compliance checks. Merchants also remain responsible for laws and acceptable-use rules.

Build the gateway around a reliable order record

The best gateway payment setup is not the one with the most logos. It is the one that gives eligible customers a clear way to pay, keeps sensitive credentials out of unsafe places, records status accurately, survives retries and abandoned sessions, and makes every party’s responsibilities visible.

For merchants comparing a combined card-and-crypto workflow, Paymegate provides hosted checkout, payment links, plugins, scoped API keys, signed webhooks, and supported crypto settlement to configured wallets. Independent providers perform the actual payment processing, and availability remains order- and provider-dependent.

Explore the card and crypto payment gateway, compare current fees, or review the developer documentation before starting an integration.