What is a payment gateway, and how does integration work?

Gateway, acquirer and payment facilitator: who does what

A card payment goes through several companies, and the brand name of a provider does not always tell you which role it plays. Knowing who does what explains the fees, the payout schedule and who answers when something goes wrong.

• Gateway: The technology layer that takes the checkout data, runs the fraud screening you contracted and routes the transaction; a pure gateway does not move the money from the sale.
• Acquirer: The institution that accredits the business to accept cards, captures approved sales and pays out the amount, minus fees.
• Payment facilitator or subacquirer: Receives the payment on behalf of the business and pays it out later, with simple onboarding and the fees and schedules it sets; many providers sold as gateways in Brazil work this way.
• Issuer and card network: The bank that issued the card approves or declines the purchase, and the card network sets the rules of the network.
• Pix and boleto: Pix is Brazil's instant payment scheme, run by the Central Bank, and boleto is a payment slip cleared by the banking network; for both, the gateway or the bank creates the charge and reports when it is paid.

How a transaction works, from checkout to reconciliation

1. Checkout: The customer picks a payment method; the card data goes straight to the gateway, which returns a token in place of the number.
2. Authorization: The gateway sends the transaction to the acquirer, which asks the issuer through the card network; the answer, approved or declined, comes back in seconds.
3. Capture: The approved sale is confirmed right away or later, for example when the order is invoiced; before capture, the authorization can be voided.
4. Notification: The gateway tells your system through a webhook at every status change, such as paid, declined, refunded or disputed.
5. Settlement and payout: The money reaches the business account on the contract schedule, minus fees; with Pix, the transfer settles in seconds.
6. Reconciliation: Every order is matched against the amount received, the fees and the payout, and whatever does not match becomes an exception for finance.

Pix and boleto involve no card data: the integration creates the charge through an API, gets back the QR code or the slip number and waits for the payment webhook. For Pix, the Central Bank standardized the Pix API, which participating institutions use when they offer API integration to their customers.

Ways to integrate: hosted checkout, embedded fields or API

The way you integrate sets the customer experience, the development effort and how much of PCI DSS, the card data security standard, stays with the business. Broadly, the less your website touches card data, the smaller the scope.

The business validates compliance with its acquirer or provider. The job of the integration is to pick the method that keeps that work small without hurting conversion.

Connecting the gateway to the ERP: orders, refunds, payouts and reconciliation

An approved payment is half the job. Finance feels what happens next, in the ERP, and that is where an incomplete integration turns into a spreadsheet.

• Order: The payment status updates the order, and the ERP releases invoicing and shipping only when the charge is confirmed.
• Refunds and disputes: A full or partial refund and a chargeback, the dispute raised by the cardholder, flow back to the ERP as entries linked to the original order.
• Payouts and fees: Every payout carries the gross amount, the fees and the net, and the ERP has to record all three, not just what landed in the account.
• Reconciliation: Automatic matching of orders, receipts and the bank statement flags only the discrepancies, such as an unexpected fee or a late payout.

In Mahout ERP, a Master Timm client, the integration hub brought together Moip/Wirecard and Asaas for payments, Melhor Envio for shipping and bank reconciliation through OFX files. We also contributed to the official PagSeguro and Mercado Pago modules for Magento 2, with 214K installs.

The mistakes that break payment integrations most often

• Unverified webhooks: Anyone can call the endpoint; check the signature or query the status through the API before marking the order paid.
• Retries that duplicate: A timeout does not mean a decline, and resending the charge without an idempotency key can bill the customer twice.
• Repeated or out-of-order events: The same webhook can arrive twice, and the refund event can arrive before the payment one; the system decides by the current status of the transaction.
• Testing only the happy path: Declines, timeouts, partial refunds and disputes belong in the sandbox tests before production.
• No log per transaction: When a customer complains, nobody can show what was sent and what the provider answered.

How to choose a gateway: what to weigh beyond the fee

A gateway's cost is rarely a single number. Typically there is a percentage per card sale that changes with installments, flat fees per Pix or boleto at some providers, the cost of advancing receivables and a fee per dispute. Compare the total cost against your sales mix, not the advertised rate.

• Payment methods: Pix, cards paid in full or in installments, boleto and the digital wallets your customers use.
• Payout schedule: When the money arrives and what it costs to get it early.
• API and sandbox: Documentation, a test environment with failure cases, signed webhooks and support for idempotency keys.
• Split payments: Required when the business is a marketplace and every sale is divided among sellers.
• Fraud screening and disputes: What the provider covers and who bears the loss of a chargeback.
• Exit: How to take the tokenized cards and the history with you if you ever switch providers.