Payment Gateway

What the gateway does

The gateway carries payment information between the checkout and the processing infrastructure. That infrastructure connects to the financial institutions involved in the payment. A gateway can serve more than a website: some providers also accept transactions from retail software or telephone-order systems.

Source: Authorize.net, “What is and who is Authorize.net?” (Gateway routing and supported submission channels for this provider); Visa, “Payments: understanding the components and solutions” (High-level gateway and processor roles only), accessed 2026-09-03.

1. The business submits the payment request through its gateway connection.
2. The request travels to processing systems for the required checks and authorization, meaning a decision to approve or decline it.
3. The payment response returns to the business. The customer's issuer, or an authorized network service acting for it, supplies the card authorization decision.

Source: Authorize.net, “What is and who is Authorize.net?” (Gateway routing and supported submission channels for this provider); Visa Developer, “Glossary” (VisaNet processor and authorization definitions), accessed 2026-09-03.

Keep the connection separate from the funds

A gateway is not a merchant bank account. In the documented card lifecycle, authorization can place a hold without transferring funds. Capture submits the authorized transaction for settlement, the later financial process. A checkout integration must distinguish those events instead of labelling each one as money received.

Source: Authorize.net Developer, “Payment Transactions” (Provider technical lifecycle, underwriting and dispute representation), accessed 2026-09-03.

Illustrative example: a response is not a receipt

Imagine a developer sees a successful Hypertext Transfer Protocol (HTTP) response, which reports the web request's status, and marks an order paid. That is insufficient evidence in some integrations. Adyen documents HTTP 200 responses that contain unsuccessful payment results. In this hypothetical case, inspect the payment-result fields and follow the provider's state-handling guidance before changing the order. The example does not describe every gateway's response format.

Source: Adyen Documentation, “Refusal reasons” (Adyen online-payment HTTP versus business-result distinction), accessed 2026-09-03.

A checkout-handoff checklist

Use these questions when documenting the integration. They are a suggested handoff checklist, not a statement that every gateway supplies every feature.

Source: Authorize.net, “What is and who is Authorize.net?” (Gateway routing and supported submission channels for this provider); Authorize.net Developer, “Payment Transactions” (Provider technical lifecycle, underwriting and dispute representation); Adyen Documentation, “Refusal reasons” (Adyen online-payment HTTP versus business-result distinction); PCI Security Standards Council, “Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?” (Outsourcing responsibility under PCI DSS), accessed 2026-09-03.

Outsourcing does not remove security responsibility

Using an external gateway does not eliminate the merchant's Payment Card Industry Data Security Standard (PCI DSS) responsibilities. The standard-setting council says merchants still need to assess their provider and understand shared duties. Confirm the applicable validation process with the organization managing your compliance program, such as your acquirer.

Source: PCI Security Standards Council, “Does PCI DSS apply to merchants who outsource all payment processing operations and never store, process or transmit cardholder data?” (Outsourcing responsibility under PCI DSS), accessed 2026-09-03.

Continue through the payment flow

Read payment processor for message handling, then payment authorization and payment capture for the next stages.

Editorial note: AI-assisted educational content prepared for HaiPay. It is not investment, legal or tax advice. The cited sources explain the concepts; your provider agreement and applicable rules govern your arrangement.