Definition
A payment gateway connects checkout to payment processing; the acquiring and payout roles depend on the provider arrangement.
A payment gateway is the technology connection between checkout and the downstream payment provider. It collects or transmits a payment request and returns the result. The provider may package that connection with acquiring and payouts, but the gateway role itself does not tell you who is responsible for those services. Visa describes the gateway as checkout technology; the payment-stack guide maps the separate commercial roles.
Choose the integration before assuming its security scope
- Provider-hosted checkout: the customer moves to a payment page operated by the provider. Ask which data and events return to your application and how the provider authenticates the result.
- Embedded provider form: payment fields may appear within your checkout while the provider serves the fields. Confirm exactly which page elements collect payment-card data and which scripts the merchant controls.
- Direct card-data API: the merchant's application handles card data before passing it on. This can bring substantially more of the merchant environment into PCI DSS scope.
An embedded or hosted form does not automatically qualify a merchant for a particular PCI self-assessment questionnaire. The PCI Security Standards Council's iframe guidance requires all elements involved in collecting or processing payment-card data to originate directly from a validated provider for SAQ A eligibility, alongside the other criteria. Confirm the right assessment and security responsibilities with your acquirer or qualified assessor for the actual implementation.
The operational distinction
If an authorization fails, the first question is whether the checkout connection sent a request and received a response. If funds were approved but a payout is missing, inspect the PSP or acquirer settlement record instead. A gateway response, an issuer authorization and a merchant payout are different events. The provider's API design, contracts and support path determine who investigates each one.
Before signing a gateway proposal, ask: Who holds the merchant agreement? Who can route to another acquirer? Who owns tokens and can export them? Who sends settlement and dispute files? These answers matter more than whether a vendor calls its bundled product a “gateway.” See the payment-architecture reading path when comparing a bundled stack with separate providers.