A payment gateway is the software layer that authorizes and encrypts card transactions between a customer’s bank and your merchant account. It captures card data at checkout, runs it through Visa, Mastercard, Discover and Amex networks, and returns an approval or decline in roughly two seconds. Without a configured gateway, an online store or virtual terminal cannot move money, no matter how strong the product or traffic.
ProTech Payments configures and supports payment gateways for businesses across Katy, Houston, Sugar Land and Fort Bend County. Setting one up correctly affects three things that show up on your statement: authorization rates (how many valid cards get approved), processing cost per transaction, and PCI DSS scope (how much compliance liability you carry). A clean setup typically saves 0.30% to 1.00% in avoidable downgrade fees and cuts false declines that quietly drain revenue.
This guide walks through gateway selection, credentials, integration methods, testing, and go-live. It applies to ecommerce checkouts, recurring billing, virtual terminals, and in-person scenarios, and the mechanics are the same whether you process $5,000 or $500,000 a month.
What a payment gateway does
The gateway sits between your checkout page and the processor (often Fiserv, the company formed from First Data). When a customer enters a card, the gateway tokenizes the number, encrypts the payload, and sends it to the acquiring bank. The bank routes it through the card network, the issuing bank checks funds and fraud signals, and an approval code travels back the same path.
A gateway is not a merchant account. The merchant account is the bank relationship that holds funds before they settle to your business checking, and the gateway is the connection that feeds that account. You need both, which is why our merchant services and payment gateway products are usually provisioned together.
Authorization versus capture
Most gateways split a sale into two events. Authorization places a hold on the cardholder’s available credit, and capture moves the money. Retailers authorize and capture in one step; restaurants authorize at the swipe and capture after the tip is added. Misconfigured capture timing is a leading cause of expired authorizations and chargebacks.
Card-present versus card-not-present
EMV chip and contactless transactions are card-present and carry lower interchange and lower fraud liability. Keyed or online transactions are card-not-present and cost more. Your gateway settings, including AVS (address verification) and CVV checks, determine whether a card-not-present sale earns the best available rate or gets downgraded.
Before you set up: what you need
Gather these items before touching any dashboard. Missing one of them stalls activation by days.
- A live merchant account with an approved MID (merchant identification number).
- Your business legal name, EIN, and bank account for funding.
- A processor assignment (for example, Fiserv, TSYS, or Elavon) tied to that MID.
- SSL/TLS on your domain. No gateway will pass live cards over an unencrypted page.
- A platform decision: hosted checkout, API integration, or a virtual terminal for phone and mail orders.
If you do not yet have a merchant account, that comes first. Our guide on what is a payment gateway explains where the gateway fits in the wider stack, and choosing a payment processor for a small business covers how to vet the account itself.
Step-by-step gateway setup
The sequence below is the order we follow when onboarding a ProTech Payments client. Skipping ahead, especially past testing, is where most self-service setups break.
Step 1: Confirm your merchant account and gateway credentials
After approval, you receive a gateway login plus API credentials: an API login ID, a transaction key or secret, and sometimes a public client key for browser-side tokenization. Store the secret in a password manager, never in front-end code or a public repository. These credentials bind the gateway to your specific MID.
Step 2: Choose your integration method
Decide between hosted checkout, a drop-in embedded form, or a full API integration. This choice drives your PCI scope and your development effort. The next section compares the three in detail.
Step 3: Connect the gateway to your platform
For WooCommerce, Shopify, or a custom site, install the gateway plugin or SDK and paste in your credentials. For online payments on WooCommerce specifically, our WooCommerce payment gateway guide covers plugin selection. For in-person and hybrid setups, the gateway links to your point of sale hardware.
Step 4: Configure fraud and security settings
Turn on AVS and CVV matching. Set velocity filters that flag, for example, more than five attempts from one IP in a minute. Enable 3-D Secure (Visa Secure, Mastercard Identity Check) for higher-ticket items, which shifts fraud liability to the issuer on authenticated transactions. Keep tokenization on so you never store raw card numbers.
Step 5: Set up funding and descriptor
Confirm the deposit bank account and the billing descriptor, the name that appears on the cardholder’s statement. A clear descriptor (your business name plus city) reduces “I don’t recognize this charge” disputes, a common and preventable chargeback source.
Step 6: Run test transactions and go live
Use the gateway’s sandbox with the published test cards (Visa 4111 1111 1111 1111 is the standard test PAN) and verify approvals, declines, refunds, voids, and partial captures. Then switch to production keys, process a real $1 transaction, refund it, and open to customers. Watch authorization rate, decline reasons, and settlement timing for the first week.
Integration methods compared
The integration method you pick determines how much card data touches your servers, which directly sets your PCI DSS self-assessment burden.
| Method | PCI scope | Customization | Setup effort | Best for |
|---|---|---|---|---|
| Hosted checkout (redirect) | Lowest (SAQ A) | Limited | Low | Small stores, fast launch |
| Embedded form / drop-in | Low (SAQ A or A-EP) | Moderate | Medium | Most ecommerce |
| Full API (direct post) | Highest (SAQ D) | Full | High | Custom platforms, marketplaces |
Hosted checkout redirects the customer to the gateway’s secure page, so card data never reaches your site. The embedded form (an iframe or JavaScript element) keeps customers on your domain while tokenizing the card before it hits your server. Full API integration gives total control but pulls your servers into the cardholder data environment, expanding PCI obligations. For most merchants the embedded form is the right tradeoff, and our PCI compliance team helps confirm the correct SAQ.
Gateway costs and fee structure
Gateway fees stack on top of interchange and assessments. Knowing each line keeps you from overpaying.
The fee layers
Every card sale carries interchange (set by Visa and Mastercard, paid to the issuing bank), network assessments (paid to the card brands), and the processor or gateway markup. Interchange is non-negotiable; the markup is where pricing models differ. Interchange-plus pricing, explained in our interchange-plus pricing guide, exposes each layer instead of bundling it into a flat rate, which usually costs less at established volume.
Typical gateway line items
| Charge | Typical range | Notes |
|---|---|---|
| Gateway monthly fee | $0 to $25 | Often waived with processing |
| Per-transaction gateway fee | $0.05 to $0.10 | On top of interchange |
| Statement / account fee | $0 to $15 | Varies by provider |
| PCI compliance fee | $0 to $20/mo | Avoidable with proper validation |
| Chargeback fee | $15 to $25 | Per disputed transaction |
A flat-rate provider like Square folds these into one percentage, which is simple but rarely cheapest at scale. Our Square fees explained breakdown shows where flat pricing quietly adds up. To eliminate the processing cost entirely from your margin, a dual pricing or cash discount program shifts the fee to customers who pay by card, which is legal in Texas when disclosed correctly.
Setup by business type
Gateway configuration changes with how you take cards.
Ecommerce and recurring billing
Online sellers need an embedded form plus tokenization for stored cards. Subscription businesses add recurring billing so the gateway re-runs saved tokens on schedule and handles card-on-file updates, with dunning to retry soft declines.
Restaurants and retail
Restaurants need tip adjustment and delayed capture; retail needs fast authorize-and-capture with EMV at the counter. A retail merchant services or restaurant merchant services setup ties the gateway to terminals like Clover so card-present sales earn lower interchange.
Phone, mail, and field sales
Businesses taking cards over the phone use a virtual terminal where staff key the card into a secure browser form, and field technicians use mobile payments tied to the same gateway. Both are card-not-present, so AVS and CVV settings carry extra weight here.
Common setup mistakes
These errors show up repeatedly in the statements we analyze.
- Leaving AVS and CVV off, which triggers downgrades and raises fraud exposure.
- Hardcoding API secrets into front-end code or public repositories.
- Skipping sandbox testing and discovering capture or refund bugs after go-live.
- Choosing full API integration when an embedded form would have kept the business in a lighter PCI SAQ.
- A vague billing descriptor that generates “unrecognized charge” disputes. Our chargeback prevention playbook covers descriptor fixes and other dispute triggers, and chargeback management handles the rest.
- Forgetting to switch from test keys to production keys, so live cards silently fail.
Texas businesses and gateway setup
Texas merchants have a specific advantage at setup time: surcharging and dual pricing are permitted under state law when the surcharge is capped at the cost of acceptance and disclosed at entry and at the point of sale. Configuring this at the gateway level, rather than bolting it on later, keeps your receipts and statement descriptors compliant from day one.
ProTech Payments works on the ground in Katy and across the Houston metro, so we configure gateways, terminals, and the funding bank link in person when a business prefers it. Whether you run a clinic in Sugar Land, a shop in Cypress, or a service company in Katy, the gateway connects to the same Texas-friendly pricing programs. New businesses can also pair gateway setup with equipment financing so terminals and the online checkout launch together.
Frequently asked questions
How long does payment gateway setup take?
With an approved merchant account and credentials in hand, a hosted or embedded gateway can go live in a few hours. A custom API integration with full testing usually takes a few business days. The slowest part is underwriting and merchant account approval, which happens before gateway setup begins.
Do I need a merchant account and a payment gateway?
Yes, for card-not-present payments you need both. The merchant account holds and settles funds, and the gateway is the encrypted connection that authorizes the card. Some providers bundle them under one application, which is how ProTech Payments usually provisions accounts.
What does a payment gateway cost per month?
Many gateways charge $0 to $25 monthly plus $0.05 to $0.10 per transaction on top of interchange. With a dual pricing program the card processing cost can be passed to the cardholder, leaving the business with little or no net fee. A free statement analysis shows your exact numbers.
Will gateway setup affect my PCI compliance?
It directly affects it. A hosted or embedded integration keeps you in the lightest self-assessment (SAQ A), while a direct API integration that handles raw card data pushes you to SAQ D with far more requirements. Choosing the right method at setup is the cheapest way to control PCI scope.
Can I use one gateway for online and in-person sales?
Yes. Modern gateways support online checkout, virtual terminal, and card-present terminals under one account, so settlement and reporting stay unified. This is the standard setup for businesses that sell both in a store and online.
What is the difference between authorization and capture?
Authorization places a hold on the cardholder’s funds; capture moves the money to settlement. Retail captures immediately, while restaurants and some services authorize first and capture later after a tip or final amount is known. Misconfigured timing causes expired holds and avoidable declines.
Talk to ProTech Payments
A correctly configured gateway approves more valid cards, costs less per transaction, and keeps your PCI scope small. Start with a free statement analysis so we can show, line by line, what your current setup costs and where a clean gateway configuration saves money. When you are ready to launch, get started with ProTech Payments and we will provision the merchant account, gateway, and Texas-compliant pricing together.
