Every list of the types of payment gateway is really one question rearranged: where does the customer physically type the card number? On the gateway’s own site, inside a frame the gateway controls, or on a page you built. That single choice sets your compliance burden, your checkout experience and how easily you can change banks later.
The three types of payment gateway, side by side
| Type | Where the card is entered | Your PCI burden | Trade-off |
|---|---|---|---|
| Hosted, or redirect | On the gateway’s own page, after leaving your site | Lowest | You lose control of the last step of checkout |
| Embedded fields, or iframe | On your page, inside frames served by the gateway | Low | Styling is limited to what the gateway exposes |
| Direct API, or server to server | On your page, posted to your server first | Highest by a wide margin | Full control, full responsibility, full audit |
Most businesses that think they need the third type actually need the second. Embedded fields look and feel like your own checkout while keeping the raw card number out of your systems, which is the whole point.
Where the card number goes decides your compliance work
If the card number never touches your servers, the scope of your PCI DSS obligations shrinks dramatically. That is not a marketing claim from a gateway, it is the structural logic of the standard: it applies to systems that store, process or transmit cardholder data.
Take the direct API route and your web server, your logs, your error reporting and anything sharing that network come into scope. Businesses take that on when they have a real reason, usually a checkout flow no hosted product can express, and a team to maintain it. Nobody should take it on because the API documentation looked nicer.
Redirect gateways and what they quietly cost
Sending a customer to another domain to pay does two things. It removes almost all of your compliance exposure. It also breaks the visual continuity of your checkout at the exact moment the buyer is deciding whether to trust you.
For an established brand selling a familiar product, that break costs little. For a newer store, or one in a category buyers are already cautious about, it can cost real conversions. If you are selling in a category where trust is the hard part, read what actually makes a business high risk before you pick the cheapest integration, because the same caution that flags you with an underwriter is present in your buyers.
Why the type matters more when you are hard to place
An account that might be closed, repriced or reserved is an account you may need to move. The gateway type decides how painful that move is.
A gateway bundled with a single processor gives you no route out. Losing the account means rebuilding checkout while sales are stopped. An independent gateway that can route to several acquirers turns the same event into a configuration change, and it is what makes holding a second merchant account practical rather than theoretical. That is the main reason a gateway chosen for a high risk account is usually an independent one, with tokenization you can export.
Ask about the tokens explicitly. Stored cards for recurring billing are your customer relationships in a database you do not own, and whether they travel with you is a contractual question, not a technical one.
Choosing between them without overthinking it
Take hosted if you sell a modest volume, want the least compliance work, and your buyers already know your name. Take embedded fields if checkout appearance matters and you would rather not run a PCI audit, which covers most online sellers. Take direct API only if you have an engineering team, a specific flow you cannot get otherwise, and a budget for annual validation.
Then choose the account behind it separately. The gateway is a component you can change. The acquiring bank is the relationship, and that decision is made on the file described in what underwriting actually looks at. When you get to that stage, the questions worth asking a processor will tell you more than any feature comparison.
Frequently asked questions
Is an all-in-one product a fourth type? Not technically. Products that bundle the gateway, the processing and the account are usually a hosted or embedded gateway with an aggregated merchant account attached. The gateway type is still one of the three, the difference is who holds the account behind it.
Does the type affect my approval odds? Not directly. Underwriting looks at your business, your history and your category, not your integration method. It can affect approval indirectly if your chosen gateway cannot connect to the acquirer that would have approved you.
Can I run two types at once? Yes, and some businesses do. A hosted flow for one-off sales and an embedded flow for a subscription portal is a common pairing. Keep an eye on reporting, because reconciling two flows into one set of books is where the extra work shows up.
What about mobile apps and payment links? Both sit inside these three categories rather than beside them. A payment link is a hosted page under another name. An in-app checkout is usually embedded fields provided by the gateway’s mobile SDK, for the same compliance reason.