How to choose a payment gateway: a no-nonsense guide

We've wired up payments for online stores, subscription platforms, and businesses selling high-value goods where a failed charge is a real problem. The gateway choice matters less than most people think. How you integrate it matters more. Here's how we walk clients through it.

What a payment gateway actually does

A gateway is the service that takes a customer's card (or wallet, or bank account), checks it with the card networks, and moves the money toward your bank. It also handles the parts you really don't want to own yourself: storing card data safely, fraud screening, and the paperwork that comes with PCI compliance.

Pick a good one, integrate it carefully, and it disappears into the background. That's the goal.

The main options

Fees below are the providers' published US standard rates when we wrote this. They change, and high-volume businesses can often negotiate, so always check the provider's current pricing page before you decide.

Stripe

• Standard online card rate: 2.9% + 30¢ per successful domestic card charge. International cards and currency conversion cost extra, and bank debits (ACH) are priced separately.
• Strengths: excellent APIs and documentation, subscriptions through Stripe Billing, wallets like Apple Pay and Google Pay out of the box, strong fraud tooling.
• Watch for: add-on products (Billing, Tax, Radar upgrades) each carry their own fee, and non-technical teams will need help with setup.
• Best for: custom checkouts, SaaS and subscriptions, and anything where your developers need control.

PayPal

• Standard rates: PayPal Checkout (including Pay with Venmo and guest checkout) is 3.49% plus a fixed fee. Standard card processing is 2.99% plus a fixed fee. International transactions add a percentage.
• Strengths: everyone recognizes it, some customers won't check out any other way, and buyer protection builds trust for unknown merchants.
• Watch for: it's more expensive per transaction than a direct card gateway for most sales, and account holds can hit fast-growing sellers.
• Best for: offering it alongside your main gateway as an extra button, rather than as your only option.

Shopify Payments

• If you're on Shopify, start here. Rates depend on your Shopify plan, and using a third-party gateway instead adds a Shopify transaction fee on top of the gateway's own.
• Best for: Shopify stores that don't have a specific reason to go elsewhere.

Venmo for Business

• Business profile rate: 1.9% + 10¢ for payments from another Venmo account. In-person Tap to Pay payments cost more.
• Watch for: it's US-only with limited reporting. For online checkout, Venmo usually arrives through PayPal Checkout, which is priced at PayPal's rate, not the business-profile rate.
• Best for: local and in-person businesses with a younger customer base. It's rarely a primary online gateway.

The costs that don't show up on the pricing page

The headline rate is only part of the bill. Before you compare providers, find out:

• Chargeback and dispute fees. Usually charged per case, sometimes even when you win.
• International and currency-conversion surcharges, if any meaningful share of your customers are outside the US.
• Add-on fees for subscriptions, tax calculation, invoicing or advanced fraud tools.
• Payout timing. Standard payouts are free, but instant payouts usually cost extra.
• Switching cost. Moving saved cards and active subscriptions between providers is possible, but it's a project, not a toggle.

What integration really involves

This is where most payment problems come from. It's also where AI-generated code most often cuts corners. A production-grade integration needs:

• Verified webhooks. The gateway tells your system when a payment succeeds, fails, is refunded or is disputed. Your system has to check that the message really came from the gateway before acting on it.
• Idempotency. Customers double-click, networks retry, and webhooks arrive twice. Every payment action should be safe to run more than once without charging twice.
• Reconciliation. A way to spot "paid at the gateway, missing in our database" and the reverse. It will happen. The question is whether you notice before the customer does.
• Real refund and failure paths, not just the happy path. Test the declined card, the expired card and the partial refund.
• Secrets handled properly. API keys live on the server, never in the browser, and get rotated if they're ever exposed.

Handled this way, the gateway keeps card numbers off your servers entirely through tokenization and hosted fields, which keeps your PCI scope small. You'll still fill out a self-assessment, but it's a short one.

Security features worth insisting on

• PCI DSS compliance on the provider side, and a small PCI scope on yours
• Tokenization, so card data never touches your servers
• 3D Secure 2 for the transactions that need extra verification
• Fraud screening you can tune, rather than a black box that declines good customers

How to choose

1. Know your numbers: monthly volume, average order size, and the share of international sales. A 0.5% difference matters very differently at $10,000 a month than at $1 million.
2. Know your customers: what they expect to see at checkout, and where they are.
3. Know your platform: Shopify, WooCommerce, or a custom app. The platform often makes the choice for you.
4. Know your team: who will own the integration and the monthly reconciliation.
5. Start small: run real transactions in test mode, then a limited live rollout, before you move everything over.

You aren't married to your gateway, but switching is work. Choose for the next few years, not the next few weeks.

Where we come in

We build and maintain checkouts, subscription systems and online stores, including custom platforms and Shopify and WooCommerce builds. If your payments already work but you're not sure they'd survive a retry storm or a dispute, that's a good thing to find out before a busy season. Tell us about your setup.