- Customer
- Rail
- Gateway
- Merchant ledger
What Is a Payment Gateway?
A payment gateway is the technology that connects a merchant's website or app to the networks that move money. The gateway captures the customer's payment details at checkout, securely transmits payment information to the right payment processor, card network or wallet operator, and returns the result to the merchant. In simple terms, the payment gateway acts as the online equivalent of a point of sale (POS) terminal in a shop: it does not hold the money, it carries the payment request and the answer.
Without a payment gateway, an online business would need a separate connection to every bank, card scheme and mobile wallet its customers use. With one, the merchant integrates once and offers multiple payment methods through the same gateway API.
How a Payment Gateway Works, Step by Step
Every online payment follows roughly the same payment process, whatever the payment method:
- Checkout. The customer chooses one of the payment options and confirms the amount on the merchant's website or app.
- Payment request. The merchant's server sends the amount, currency and order reference to the payment gateway through its API, or redirects the customer to a hosted payment page.
- Encryption and routing. The payment gateway encrypts the sensitive payment data and forwards the request to the payment processor, card network or mobile money operator that handles the chosen method.
- Authorisation. The customer's bank or wallet checks the balance, runs its own fraud and risk checks and asks the customer to confirm, for example with a PIN or 3-D Secure code. The issuer then approves or declines the transaction.
- Response. The result (approved, declined or pending) travels back through the processor to the payment gateway.
- Notification. The gateway informs the merchant, usually through a webhook or postback sent to the merchant's server, and the website shows the outcome to the customer.
- Settlement. Later, the collected funds are transferred to the merchant's bank account, minus fees, and both sides reconcile their records.
Authorisation usually takes seconds. Settlement depends on the payment gateway provider's terms: some send merchant funds the same day, others after several days.
Payment Gateway and Payment Processor: What Is the Difference?
The terms are often mixed up, but each party in a digital payment has its own job:
- Payment gateway: the merchant-facing layer that captures the customer's payment details, routes the transaction and returns the status.
- Payment processor: the system that moves transaction data between the gateway, the card network or wallet operator and the banks. The payment processor's job ends when the transaction is authorised and cleared.
- Acquiring bank and merchant account: for card payments, the acquiring bank holds the merchant account into which card funds are settled.
- Issuing bank: the customer's financial institution that issued the credit card or debit card and approves or declines the payment.
- Payment service provider (PSP): a company that bundles several of these roles into one payment service. In Kenya, payment service providers are overseen by the Central Bank of Kenya under the National Payment System Act.
Many payment providers offer the gateway and the processor as a single product, which is why the difference between a payment gateway and a payment processor is easy to miss.
Types of Payment Gateways
Hosted payment gateway
The customer is redirected to a payment page run by the gateway provider, completes the payment there and returns to the merchant's site. Hosted gateways are the quickest to launch and keep sensitive payment data away from the merchant's servers.
API or host-to-host gateway
The merchant's server talks directly to the payment gateway API and the merchant designs its own payment form. This gives full control of the payment experience, but developers must build the screens and handle every status.
Self-hosted payment gateway
The payment form sits on the merchant's site, and the collected details are passed to the gateway in the background. Card data handled this way increases the merchant's security obligations.
Local bank and wallet integrations
Some businesses connect directly to a single bank or a mobile money API. This works for one method, but each new payment method means another integration.
How Mobile Money Payments Work in Kenya
In Kenya most online payments start on a mobile phone. With M-Pesa, money moves between digital wallets rather than through a card network, so the flow looks different from a card payment:
- STK Push: the gateway triggers a prompt on the customer's phone, and the customer enters their M-Pesa PIN to approve. This is the usual flow for e-commerce checkout. Direct integrations use the Safaricom Daraja API.
- PayBill: the customer enters the business's PayBill number and an account reference, which helps the merchant match the customer payment to an invoice.
- Till Number (Lipa na M-Pesa Buy Goods): the customer pays to a Buy Goods Till, often shown at a retail counter.
A payment gateway that supports mobile money turns these flows into one API: it starts the payment, waits for the wallet operator's confirmation and sends the result to the merchant. Other alternative payment methods, such as Airtel Money or India's Unified Payments Interface (UPI), work in a similar way, but every payment gateway supports its own set of methods, so check which ones are actually connected.
How Card Payments Work
Card payments follow the card network path. The payment gateway encrypts the card details, the acquirer sends them through Visa or Mastercard to the issuing bank, and the issuer decides whether to authorise the electronic payment. Many issuers ask for 3-D Secure confirmation in a banking app or by one-time code. The amount can be captured immediately or later, and funds settle to the merchant account in batches.
Because card data is sensitive, gateways use tokenization to replace the card number with a token and follow the Payment Card Industry Data Security Standard (PCI DSS). A hosted payment page reduces the merchant's PCI DSS scope. Card payments can also be disputed through chargebacks, which mobile money payments handle differently.
Bank Transfers
Bank transfers move funds directly between accounts and are common for larger business-to-business payments. Check whether your provider returns a machine-readable reference, or whether your finance team has to match each bank entry by hand.
Webhooks: How the Merchant Learns the Payment Status
Many payments are asynchronous. A request to start an STK Push can be accepted before the customer has approved it, and a 3-D Secure check can take a minute. The payment gateway therefore sends the final status later, through a webhook (also called a postback or callback) to the merchant's server.
- Keep the order pending until a verified status arrives. A closed browser tab is not a payment result.
- Store identifiers: save the gateway's transaction ID next to your own order reference.
- Handle retries: a late result for the first attempt can still arrive after the customer tries again. Match amount and currency before fulfilment and treat a second success as an exception.
Settlement and Reconciliation
Settlement is the transfer of collected funds to the merchant. Reconciliation is the check that every financial transaction reported by the gateway matches an order in your system and an amount received in your bank account. Download transaction reports from the gateway dashboard or API, keep the payment timestamp and the settlement timestamp in separate fields, and investigate missing or duplicate payments early. Read more about how settlement timing affects the cost of payments.
Key Features of a Payment Gateway
- Payment methods: the cards, wallets and bank transfers the payment gateway offers in each country.
- Secure payment handling: encryption, tokenization and secure communication between servers.
- Status notifications: webhooks for every approved, declined and pending payment.
- Payouts: sending money from the business to customers, for example refunds or withdrawals.
- Reporting: a dashboard and exportable reports for reconciliation and management.
- Settlement terms: how often funds are sent, in which currency, and whether any reserve is held.
How to Choose the Right Payment Gateway for Your Business
Knowing how a payment gateway works helps you ask better questions when you choose a payment gateway. There is no single best payment gateway for every company; the right payment gateway is the one that matches your customers and your operations:
- Which popular payment methods do your customers use, and are they live, not just listed?
- Does the gateway provider offer a hosted page, an API, or both?
- How are statuses reported, and how does the payment gateway serve failed or pending payments?
- When is settlement sent, and what are the transaction fees?
- Can you add different payment methods and countries through the same integration?
For Kenya-specific comparisons, see how to compare gateways by the operating job your business needs.
Frequently Asked Questions
How does a payment gateway work in simple terms?
It takes the payment request from your checkout, sends it to the bank, card network or wallet that can approve it, and returns the answer to your website. Later, the collected money is settled to your account.
Is a payment gateway the same as a payment processor?
No. The gateway is the merchant-facing connection; the processor moves transaction data between the gateway, networks and banks. Many payment providers offer both as one service.
How long does a gateway payment take?
Authorisation usually takes seconds, although M-Pesa and 3-D Secure payments wait for the customer to confirm. Settlement to the merchant depends on the provider's terms.
Can I accept payments without a payment gateway?
You can integrate the Safaricom Daraja API or a bank directly, but a payment gateway handles the connection, statuses and reconciliation for you and can add other methods and countries through the same integration.
Can I accept international payments through a payment gateway?
Yes, if the gateway supports the payment methods and currencies of your customers' countries. Cross-border coverage varies widely between providers.