Decision guide
Hosted Checkout vs Embedded Fields vs Direct API
How should your product integrate card payments with a PSP?
Side by side
| Criterion | Hosted checkout / redirect | Embedded fields / drop-in | Direct API with raw card data |
|---|---|---|---|
| Card data on your servers | No | No | Yes |
| Typical PCI assessment | SAQ A | SAQ A or A-EP | SAQ D / Report on Compliance |
| UX control | Branding only | High | Full |
| 3DS / SCA handling | PSP | PSP SDK | You |
| Payment methods (wallets, local) | Built in | Built in (drop-in) or per method | Build each |
| Integration effort | Low | Medium | High |
| Conversion | Good (redirect step) | Best (in-page) | Best (if done well) |
When to choose each
Hosted checkout / redirect
Customer pays on a PSP-hosted page and returns to your site.
Choose when
- Fastest launch, small teams
- Minimal PCI scope (SAQ A)
- Many payment methods out of the box
Avoid when
- Highly customized, single-page checkout UX
Embedded fields / drop-in
PSP-hosted iframes or SDK components inside your checkout.
Choose when
- Custom checkout UX with low PCI scope
- Mobile apps using PSP SDKs
Avoid when
- Teams that can't control third-party scripts on payment pages
Direct API with raw card data
Your servers receive card numbers and send them to the PSP.
Choose when
- Payment facilitators, vaulting providers, large processors with PCI programs
Avoid when
- Almost everyone else
Verdict
Start with hosted checkout to launch quickly with minimal compliance burden; move to embedded fields/drop-in when checkout UX becomes a differentiator. Handle raw card data only if payments are your core business and you can sustain a full PCI DSS program. In every model, fulfil orders from verified webhooks, not redirects.
Learn more
- Payments & Money APIs
- API Security in Depth
- Web Security & WAF
- API Design
- Verify incoming webhooks in FastAPI (FastAPI)
- Verify webhook signatures in Express (Node.js)
- Make a PHP payment endpoint idempotent (PHP)