To integrate a payment gateway with your ecommerce website, open a merchant account, choose how your checkout connects to the gateway (a platform plugin, a hosted payment page, embedded payment fields or a direct API), add your API keys, test everything in the gateway's sandbox, then switch to live keys.
The method you pick decides how much code you write and how much PCI compliance work you carry. This guide walks through each method, the integration steps, platform notes for Shopify and WooCommerce, and the mistakes that cause failed or double charges. If you are new to gateways, start with how payment gateways work.
4 Ways to Integrate a Payment Gateway
Every integration answers one question: where does the customer type their card or bank details? The closer that happens to your own servers, the more control you get and the more security work you take on.
1. Platform plugin or app
- How it works: install the gateway's plugin from your store platform, such as Shopify or WooCommerce, and paste in your API keys.
- Effort: lowest. No custom code.
- PCI form: usually SAQ A or SAQ A-EP, depending on how the plugin collects card data.
- Best for: stores already on a platform.
2. Hosted payment page
- How it works: at checkout the customer is sent to the gateway's own payment page, then returned to your site.
- Effort: low. You add a redirect and handle the return.
- PCI form: SAQ A, the shortest, because card data never touches your site.
- Best for: small stores that want the least compliance work.
3. Embedded payment fields
- How it works: the gateway's card fields load inside your checkout page (in an iframe), so customers never leave your site.
- Effort: medium. You add the gateway's JavaScript and style the fields.
- PCI form: SAQ A when the fields are fully hosted by the gateway; SAQ A-EP when your own page builds the form.
- Best for: stores that want a branded checkout.
4. Direct API
- How it works: your server receives the card or bank details and sends them to the gateway's API.
- Effort: highest. Developers build, secure and maintain the payment flow.
- PCI form: SAQ D, the longest, because card data passes through your systems.
- Best for: large businesses and platforms with their own payments team.
The SAQ (Self-Assessment Questionnaire) is the yearly form that shows you meet the PCI Data Security Standard. Your acquiring bank or processor tells you which one applies.
How to Integrate a Payment Gateway: Step by Step
Step 1: Open a merchant account
To accept cards you need a merchant account, where card sales land before they reach your business bank account. Many providers set up the gateway and the merchant account together. See what a merchant account is.
Step 2: Choose a gateway that fits your store
Check four things before you sign: it supports your platform, it takes the payment methods your customers use (cards, digital wallets, ACH, eCheck), it accepts your industry in writing, and its fees work at your sales volume. High-risk businesses should confirm approval first, because mainstream gateways close risky accounts after they go live.
Step 3: Pick your integration method
Use a plugin if your platform has one. Otherwise choose a hosted page or embedded fields unless you have a clear reason to handle card data yourself.
Step 4: Get your API keys and sandbox access
The gateway gives you two sets of keys: test keys for its sandbox (a practice environment where no real money moves) and live keys. Each set usually has a public key, which can sit in your checkout page, and a secret key, which must stay on your server.
Step 5: Build or install the checkout
- Serve every page over HTTPS.
- Collect card details only through the gateway's plugin, hosted page or fields.
- Save cards as tokens (stand-in values from the gateway) for repeat purchases and subscriptions, never as card numbers.
- Show clear errors when a payment is declined, so the customer can try another card.
Step 6: Set up webhooks
A webhook is a message the gateway sends to your site when something changes: a payment settles, fails, is refunded or is disputed. Your order system should update from these messages, not only from what the browser reports at checkout. This matters most for ACH, where a payment can be returned days after the customer checks out.
Step 7: Test every outcome
In the sandbox, run approvals, declines, refunds, partial refunds, voided payments and 3-D Secure checks, where the customer's bank asks for an extra code. For ACH, test a returned payment. Also click "Pay" twice to make sure the customer is charged once.
Step 8: Go live and watch the first week
Swap test keys for live keys, run one small real payment and refund it, then watch approval rates, declines and webhook errors for the first few days.
Platform Notes: Shopify, WooCommerce and Custom Sites
- Shopify: add an outside gateway under your store's payment settings. Shopify charges its own transaction fee on payments through third-party gateways, on top of the gateway's fees; the rate depends on your plan (see Shopify's help center).
- WooCommerce and WordPress: install the gateway's plugin and enter your API keys in the WooCommerce payment settings.
- Custom sites and apps: use the gateway's API and SDKs (ready-made code libraries). See how to integrate a payment API into a web application.
Adding ACH and eCheck to Your Checkout
Bank payments let customers pay straight from their bank account, which helps buyers without a credit card and suits large orders. With SeamlessChex, ACH and eCheck cost up to 90% less than cards.
- Verify the account: bank login tools such as Plaid confirm the account and balance before the payment is sent, which prevents most returns.
- Capture authorization: Nacha rules require the customer's authorization for an ACH debit, so your checkout must record it.
- Plan for returns: an ACH payment can be returned for reasons like insufficient funds after checkout, so ship on settlement or handle returns through webhooks.
Learn more about ACH payment processing and eCheck processing.
Common Payment Gateway Integration Mistakes
- Secret key in browser code: anyone can read it and use your account.
- No webhooks: orders show as paid when the payment later failed or was returned.
- Only testing approvals: declines and refunds then break in front of real customers.
- Storing card numbers: pulls your whole system into PCI scope. Use tokens.
- No protection against double submits: a customer who clicks twice is charged twice. Many gateways support an idempotency key, a unique ID per order that stops duplicates.
How SeamlessChex Integrates With Your Website
- APIs for ACH, eCheck and credit card payments, with documentation, SDKs, sample code and a sandbox. See the developer guide.
- WordPress plugins: Seamless ACH and SeamlessChex eCheck are published in the WordPress plugin directory.
- Hosted checkout: add a bank payment button with Seamless ACH Checkout.
- Card integrations: NMI, Authorize.net and Fluidpay, plus Shopify for eCheck.
SeamlessChex works with high-risk and hard-to-place businesses. Contact us to plan your integration.
Payment Gateway Integration FAQ
How long does payment gateway integration take?
It depends on the method. A platform plugin can be running once your account is approved. A custom API integration takes developer time to build, secure and test.
Do I need a merchant account to integrate a payment gateway?
Yes, to accept cards. The merchant account receives card sales before they reach your business bank account. Many providers open it together with the gateway.
What is the most secure way to integrate a payment gateway?
A hosted payment page or fully hosted payment fields. Card details never touch your servers, which keeps you on SAQ A, the shortest PCI form.
What is a payment gateway API?
A set of instructions your website or app uses to send payments to the gateway and get results back, such as approved or declined. Gateways publish documentation and SDKs to make it easier.
Can I use more than one payment gateway?
Yes. Larger and high-risk merchants often use two so they can spread sales across banks and keep taking payments if one account is paused.
Can I accept ACH payments on my ecommerce website?
Yes. Add an ACH gateway through a plugin, a hosted checkout button or the API. Verify the customer's bank account and record their authorization at checkout.