Payment gateway vs payment processor
Also known as: payment gateway, payment processor, card processor, merchant services provider
A payment gateway is the front door that securely captures a customer's card details at checkout and sends them on, while a payment processor does the behind-the-scenes work of routing the transaction through card networks and banks.
While the two terms get used interchangeably, and companies like Stripe bundle both, the distinction still matters when you're comparing fees, switching providers, or troubleshooting a failed payment.
Payment gateway vs payment processor, explained at three levels
At home
When you buy something online, the payment gateway is like the cashier who takes your card and checks it's real. The processor is like the courier who carries the request to your bank and brings back a 'yes' or 'no.' You only see the checkout page, but both are working in the background.
At work
A business that wants to take card payments needs both pieces. The gateway connects your website or terminal to the payment system, and the processor handles the communication with the banks. Many providers now sell them together, so a small business may not need to pick each separately.
At home
The gateway encrypts your card details so the store's website never has to handle them in plain form, which is why many checkouts use a pop-up or embedded form from the payment company. The processor then sends an authorization request through the card network to your bank, which approves or declines it in a second or two.
At work
Pricing differs by setup. Bundled providers charge a flat rate per transaction, while separate gateway and processor arrangements often use interchange-plus pricing, which can be cheaper at higher volumes. Card data handling also affects your PCI DSS scope: using a hosted gateway form keeps raw card numbers off your servers and shrinks your compliance burden.
At home
A card payment has two stages: authorization (the bank places a hold) and capture (the merchant claims the money), followed by clearing and settlement, often a day or two later. Gateways expose these as API calls. In my opinion, understanding that split explains most of those confusing 'pending' charges on your statement, like a hotel hold that later changes amount.
At work
When evaluating providers, look past the label to the architecture: who holds the merchant account (you, or a payment facilitator), who stores card tokens (and whether they're portable if you leave), how authorization rates compare by card type and region, and whether you can route across multiple processors. Token portability is the trap. Switching providers without it means re-collecting every customer's card.
Real-world examples
At home
Carlos ordered a jacket from a small online shop. The checkout form was supplied by the shop's payment gateway, which encrypted his card number. The processor sent the request through Visa to his bank, which approved it in about a second, and the shop got a 'success' message without ever seeing his full card number.
At work
Lena runs finance for a growing online retailer that started on a flat-rate bundled provider. At their current volume, she modelled a separate gateway with interchange-plus processing and found meaningful savings. Before switching, she confirmed that the old provider would export stored card tokens, so customers wouldn't have to re-enter their cards.
How it compares
| feature | Payment gateway | Payment processor |
|---|---|---|
| Main job | Capture and secure card data, pass it on | Route transactions to card networks and banks |
| Where it sits | Between the checkout and the payment system | Between the merchant's bank and the card networks |
| Customer sees it? | Sometimes, as the checkout form | Almost never |
| Compliance impact | Hosted forms reduce PCI DSS scope | Handles card data in the network |
| Example | Authorize.Net | Moneris, Fiserv, Global Payments |
The gateway is the front door; the processor is the hallway behind it. Many providers bundle both.
For analysts
When you write requirements for a payments change, specify token portability and multi-processor routing explicitly. I've seen businesses locked into a provider for years simply because nobody asked who owned the stored cards. That one clause can be worth more than the per-transaction rate.
History & origin
As online shopping took off in the mid-1990s, merchants needed a way to send card data from websites to the existing card-processing world. Authorize.Net, founded in 1996, became one of the earliest standalone gateways. For years, a merchant typically signed up separately for a merchant account with an acquiring bank, a processor, and a gateway. Companies such as PayPal, and later Stripe (launched publicly in 2011), collapsed these layers into a single sign-up by acting as payment facilitators. In Canada, Moneris, formed in 2000 by RBC and BMO, became a dominant processor for in-person card payments. I'd argue the bundling was the real innovation. The technology existed already, but nobody had made it easy.