AI-Powered Summary
- A payment gateway connects the checkout process to the payment ecosystem, securely routing requests and returning transaction statuses.
- It facilitates communication among participants like the customer, merchant, banks, and card networks, while protecting transaction data.
- The payment process involves steps such as checkout initiation, request creation, authentication, authorisation, and settlement.
- Different payment modes like cards, UPI, net banking, and wallets have unique flows, requiring thorough testing for each mode.
- Merchants must manage post-payment tasks like reconciliation, refunds, chargebacks, and access control to ensure smooth operations.
- PayU’s payment gateway supports multiple payment modes and provides tools for transaction management, settlements, and refunds.
When a customer clicks “Pay”, several systems have to exchange information before the business can confirm the order. A payment gateway connects the checkout to this wider payment ecosystem. It securely routes the payment request, returns the approval or decline status, and helps the merchant maintain a consistent customer experience across payment modes.
The visible part may take only a few seconds, but authorisation is not the end of the story. Businesses also need to understand payment confirmation, settlement, reconciliation, refunds and disputes. This guide explains the full flow in practical terms.
Table of Contents
What does a payment gateway do?
A payment gateway is technology that routes and facilitates the processing of a payment transaction. In India, the Reserve Bank of India defines it as infrastructure that performs this function without handling funds.
At checkout, the gateway connects the merchant to the appropriate payment participants. It protects transaction information in transit, sends the request and returns a usable status. Gateway services may also provide payment pages, dashboards, APIs, plugins and operational tools.
A gateway is not the same as the customer’s bank, the merchant’s acquiring bank or the card network. It coordinates communication among the relevant systems. The fund-collection and merchant-settlement layer may be provided alongside it by a payment aggregator.
Who is involved in an online payment?
A card transaction commonly involves the customer, merchant, gateway, processor or acquiring bank, card network and issuing bank. A payment aggregator may collect the approved funds for its onboarded merchant and settle them later. For UPI, net banking or wallets, the participants and routes change, but the request, authentication, decision and settlement pattern remains similar.
How does a payment gateway work step by step?
1. The customer starts checkout
The customer reviews the order and selects a payment mode. The merchant creates a unique reference to match the payment to the purchase later.
2. The merchant creates a payment request
The merchant’s server sends the gateway the amount, currency, order reference and other required fields. Depending on the integration, the customer may be redirected to a hosted payment page, see an embedded checkout, or remain within the merchant’s app.
Credentials and signing secrets must stay out of browser or mobile-app code. Follow current provider documentation.
3. Payment information is protected
Secure transmission, encryption and, where supported, tokenisation limit exposure of payment data. A hosted page moves much of the capture to the provider, but the merchant must still secure its website and integration.
4. The request is routed for authentication and authorisation
The gateway sends the payment request through the appropriate processor, bank or network. The customer may complete an authentication step, such as entering a one-time password, approving a UPI collect request, or authorising a payment in a UPI app.
The relevant bank or participant checks factors such as credentials, account status, available balance or credit, limits and risk signals. It then approves or declines the transaction.
5. The response returns to the merchant
The result travels back through the chain to the gateway. The gateway displays a customer-facing result and sends transaction information to the merchant’s system.
The browser return page should not be the only source of truth: it may be interrupted or manipulated. Verify payment through the provider’s signed server response, webhook or status API.
6. The order state is updated safely
After verified confirmation, the merchant marks the order paid. Delayed or repeated notifications must not create duplicate orders, invoices or shipments—an important property called idempotency.
7. Approved funds move towards settlement
Authorisation confirms that the transaction can proceed, but the merchant does not necessarily receive the money at that exact moment. The approved transaction moves through clearing and settlement. Where a payment aggregator collects the funds, it settles the merchant according to the terms in the merchant agreement and the applicable payment rules.
8. The business reconciles the transaction
Finance or operations teams match orders, gateway transaction IDs, fees, refunds, adjustments and bank credits. Good reconciliation reveals missing settlements, duplicate records and amount mismatches before they turn into customer or accounting problems.
Authorisation, capture and settlement are different
These stages are easy to confuse:
| Stage | What it means | What the merchant should do |
|---|---|---|
| Authentication | The payer completes an identity or consent step required for the mode | Wait for a verified final status |
| Authorisation | The issuer or relevant participant approves or declines the request | Confirm the order only after server-side verification |
| Capture | An authorised amount is submitted for completion; availability depends on the flow | Follow the provider’s integration rules |
| Settlement | Funds are credited through the payment chain to the merchant | Match the bank credit against the settlement report |
Not every payment method presents these stages to the merchant in the same way. Businesses should avoid hard-coding assumptions from one mode into all others.
Does the flow change by payment mode?
Yes. A card payment typically travels through acquiring and card-network infrastructure to the issuer. A UPI payment may ask the customer to approve through an installed UPI app or another supported flow. Net banking normally takes the customer into their bank’s authentication experience. A wallet transaction follows the wallet provider’s authorisation process.
These differences affect redirects, timeouts and pending states. Test every enabled mode on realistic devices and networks rather than treating one successful card test as complete coverage.
How payment gateways help secure transactions
PCI DSS is an industry security standard for organisations that store, process or transmit payment card data. Choosing a PCI DSS-compliant provider is important, but it does not automatically make every merchant system compliant. The merchant must understand its own scope, keep software patched, protect API credentials, restrict dashboard access and avoid logging sensitive data.
The RBI’s 2025 directions require payment aggregators to maintain security and fraud-prevention controls and ensure merchant infrastructure meets applicable standards. Confirm the division of responsibilities during onboarding.
What businesses must manage after payment
- Pending and failed transactions
Do not convert every non-success response into an immediate failure. Some transactions may remain pending while systems resolve the final state. Define how long to wait, when to query status and what message customers see.
- Refunds and chargebacks
A refund is initiated by the merchant; a chargeback or dispute follows a separate process raised through the payment ecosystem. Keep proof of fulfilment, clearly display return policies, and track refund status until completion. Under current RBI PA directions, refunds are made to the original payment method unless the payer specifically instructs credit to an alternate mode belonging to the same payer.
- Reconciliation and access control
Reconcile daily at a useful level of detail—not only the total credited to the bank. Limit dashboard permissions by role, enable strong authentication and review credential use. Operational discipline is as important as the checkout code.
How PayU’s Payment Gateway can help
PayU’s payment gateway helps Indian businesses accept payments across modes including UPI, cards, net banking, wallets, EMI and BNPL. Depending on the business’s technology, integration options include hosted checkout, plugins, APIs and SDKs.
PayU also provides merchant tools for viewing transactions and managing related payment operations such as settlements and refunds. Availability varies by merchant category, payment mode and approval. Technical teams should use the latest PayU developer documentation for credentials, request validation, response handling and testing requirements.
FAQs
The customer-facing authorisation response often returns quickly, but timing varies by payment mode, bank, network and connectivity. Settlement to the merchant is a separate process governed by the merchant agreement.
No. The merchant should verify the transaction through the provider’s authenticated server-side mechanism, such as a signed response, webhook or status API. The browser page alone is not a reliable source of truth.
The relevant bank or payment participant returns a decline response. Reasons may include failed authentication, insufficient funds, limits, risk checks or temporary technical issues. The merchant should show a helpful retry option without exposing sensitive details.
Under the RBI definition, a gateway does not handle funds. Settlement is performed through the acquiring and aggregation arrangements. One provider may deliver both gateway technology and payment aggregation as a combined merchant service.
No. Gateways and payment providers can apply risk controls, but no system can guarantee zero fraud. Merchants also need secure accounts, sensible access controls, order-risk checks and a documented dispute process.
