Understanding the pieces of ecommerce

The pieces needed for ecommerce

To accept credit card payments online, a merchant typically needs all of the following:

• A website. Small sites can be static and hand-coded, or larger and dynamic, built on a CMS like WordPress, Squarespace, Webflow, Drupal, or similar.

• An ecommerce platform. Foxy is an example. Most ecommerce platforms bundle in their own CMS — Foxy is different in that it doesn’t.

• A payment gateway. The ecommerce platform’s checkout page collects payment information from the customer and sends it to the gateway to authorize the transaction. The gateway responds with success or failure (and an error code on failure). Most gateways charge a monthly fee plus a small per-transaction fee (around $0.05 USD), and typically batch transactions to the merchant account once a day. Common gateways include Authorize.net, Stripe, Braintree, and Chase Paymentech.

• A merchant account. This is what actually captures the money from transactions the gateway processes — it’s where the 2-4% credit card processing fee comes from, along with per-transaction and sometimes other fees. Once a day, the merchant account deposits its batched funds into your bank account. Depending on the provider, fees may come out with each daily batch or all at once monthly. Some gateways are provided directly by the merchant account provider (SecureNet, Stripe, Braintree, PayPal Payments Pro, and others).

• A bank account. Where the money finally lands.

• Accounting, inventory, marketing, and similar systems. Important for running the business, but they don’t factor into the transaction flow itself.

Foxy offers two merchant + gateway options for US-based merchants, and supports 100+ gateways more broadly.

Combined gateway and merchant account systems

Some providers combine two or three of the pieces above:

• PayPal Payments Pro rolls the gateway and merchant account together effectively, and can even act somewhat like a bank account (though it isn’t regulated as one). It also offers basic cart and checkout functionality, making it something of an ecommerce platform too.

• 2Checkout similarly offers limited cart, gateway, and merchant account functionality in one package.

Ecommerce platforms with built-in merchant accounts or gateways

Many ecommerce platforms advertise their own merchant account and gateway services. In the vast majority of cases, these are white-labeled versions of another company’s services. There’s nothing wrong with this, but it’s unlikely to offer competitive pricing compared to sourcing a gateway and merchant account separately.

Authorization and capture: how the money flows

One of the most misunderstood parts of credit card processing is the relationship between authorization and capture. A gas station is a useful analogy: you insert your card at the pump, and it’s authorized for an estimated amount (say, $75). This authorization confirms funds are available but doesn’t charge the card yet, since the final amount isn’t known. Once you finish pumping and the actual total is known ($45.03, say), the system captures that amount. The first step is an “auth-only” transaction; the second is the capture.

A more common pattern is doing both at once — an “auth+capture” — the way a grocery store checkout works: the total is known immediately, so the card is authorized and captured in a single step.

Auth-only is sometimes used for pre-orders or trial billing periods, but it comes with tradeoffs:

• Authorizations hold funds. If you authorize $300, that amount becomes unavailable to the customer even before you capture it. If the authorization expires without a capture, the hold releases — but the customer may have overdrafted in the meantime.

• Authorizations expire. Three days is a reasonable upper bound for most cases; 30 days is roughly the outer limit, though the exact window depends on the gateway and card type (Visa, Mastercard, Amex, etc.).

• You can’t capture more than you authorized. Some gateways only allow capturing up to the authorized amount; others allow capturing slightly more, up to a percentage or dollar-amount ceiling above the original authorization (for example, PayPal’s authorization and capture rules).

Auth-only is better suited to situations with expected variation between the authorized amount and the final charge — variable shipping costs, or products that may not always be available, for example. In most other situations, an auth+capture is the simpler and more reliable choice. If your use case requires auth-only processing, test thoroughly and stay current on your gateway’s policies, since these details can change.