What Is a Payment Gateway?

A payment gateway is the service that takes a customer's payment details at checkout, sends them securely for authorisation, and tells your website whether the payment succeeded — so an order can be confirmed. It sits between your website and the banking system, encrypting card and UPI details so they never touch your servers, checking the payment for fraud, and returning a yes or no in seconds. Without one, a website can display prices but cannot take money.

The customer chooses a payment method at checkout and the gateway encrypts their details. It sends the request to the acquiring bank, which routes it through the card network or UPI to the customer's bank. That bank checks the balance or credit limit and any authentication — an OTP, a UPI PIN — and approves or declines. The answer travels back through the same chain, and the gateway tells your website, which confirms or fails the order. The whole loop takes a few seconds. The money itself moves later, in the settlement cycle, usually reaching your account the next working day.

The gateway is the front door and the processor is the plumbing. The gateway captures the payment at checkout, secures the data and returns the approve-or-decline answer; the processor moves the transaction between the acquiring bank, the card networks and the issuing bank, and handles settlement. In India most merchants never deal with the two separately, because payment service providers bundle gateway, processing and settlement into a single account and a single rate.

A merchant account is where money lands after a payment is processed; the payment gateway is what captures and authorises that payment in the first place. Historically a business had to arrange each separately with a bank. Today Indian payment service providers issue both together — you open one account, and the provider settles into your ordinary business bank account, which is why most merchants never encounter the distinction.

There are three practical types. A hosted gateway redirects the customer to the provider's page to pay — simplest to set up and lightest on compliance. A self-hosted or integrated gateway keeps the payment on your own site through an API, giving you control of the experience and more responsibility for security. An in-context or popup gateway sits between the two: the payment window opens over your page without a redirect, which is now the common default because it converts better than redirecting while keeping the compliance burden with the provider.

A customer buys a ₹1,000 item on your site and chooses UPI. The gateway opens their UPI app with the amount filled in; they approve with their PIN. Their bank checks the balance and approves, the answer returns through the gateway, and your site confirms the order — all within a few seconds. At a 2% rate you are charged ₹20 plus ₹3.60 GST, and ₹976.40 reaches your bank account the next working day.

Because a website can display a price but cannot collect money on its own, and it must never store card details itself. The gateway handles encryption, authentication and fraud checks, keeps card data off your servers so the compliance burden stays with a specialist, and gives you an auditable record of every transaction. The alternative — asking customers to transfer to a personal UPI ID — has no confirmation, no refunds, no records for GST, and risks your account being frozen for business-like activity.

A regulated payment gateway is considerably safer than handling payment details yourself. Card data is encrypted and tokenised so it never reaches your servers, transactions are screened for fraud, and providers operate under RBI regulation and card-network security standards. The realistic risks sit on the merchant's side: a compromised admin login, an unpatched website, or accepting a customer's screenshot as proof of payment instead of checking the gateway dashboard.

UPI across all apps including intent and QR, RuPay, Visa, Mastercard, Amex and Diners cards, RuPay credit card on UPI, net banking across major Indian banks, wallets, buy-now-pay-later, EMI in card, cardless and no-cost forms, and international cards for exporters. For most Indian businesses UPI now carries the majority of transactions, which matters when comparing pricing.

You pay a percentage of each successful transaction — broadly 1.5% to 3% depending on the payment method — plus 18% GST on that fee, with no setup fee and no annual maintenance charge on a standard Indian online account. Domestic UPI, cards and net banking sit at the lower end; international cards and EMI cost more. Cashfree publishes a standard domestic rate of 1.95%, with 0% for new merchants on up to ₹20 lakh a month until 31 March 2027.

Usually a few working days. Signing up takes minutes, and the time is spent on KYC review — your business PAN, bank proof, entity registration document and, where you have goods to ship, the policy pages on your website. Approval depends on how complete the documents are rather than on how large the business is. Missing website policy pages are the most common reason an application is delayed.

Only in ways that do not scale. A personal UPI ID or a bank transfer gives you no automatic confirmation, no refund mechanism, no dispute support and no clean records — and banks freeze personal accounts showing business transaction patterns. If you want to avoid building an integration rather than avoid a gateway, payment links and hosted payment pages let you collect through a provider without a website at all.

MDR — merchant discount rate — is the percentage deducted from a merchant's sale on a card or digital transaction, shared between the acquiring bank, the card network and the payment provider. In everyday Indian usage, MDR and payment gateway charges mean the same thing to a merchant. RBI has mandated zero MDR on UPI and RuPay debit for merchant transactions in specified categories, which is a large part of why UPI is cheap to accept.

Settlement is the transfer of collected money from the provider into your bank account, and it happens after authorisation, not at the same time. The standard Indian cycle is T+1 — one working day after the transaction — with faster settlement available as a paid feature. A settlement arrives as a batch of many transactions net of fees, which is why you reconcile from the provider's report rather than your bank statement.