Payments, explained in plain English.

All terms

3D Secure

3D Secure (3DS) is an extra authentication step, such as a bank app approval or one-time code, that card issuers can require to confirm the cardholder is making the payment.

Agentic commerce

Agentic commerce is buying and selling where an AI agent acts for a person: it finds products, builds the order and completes the payment within limits the person approved.

Chargeback

A chargeback, or dispute, happens when a cardholder asks their bank to reverse a payment. The bank pulls the funds back from the merchant until the dispute is resolved.

Embedded checkout

Embedded checkout places a payment form inside the merchant's own website or app, usually through a provider-controlled frame, so the customer never leaves the page.

Hosted checkout

Hosted checkout is a payment page run by a payments provider or platform that a merchant redirects customers to, instead of building its own checkout form.

Idempotency key

An idempotency key is a unique value sent with an API request so that, if the request is retried, the server returns the original result instead of performing the action twice.

Independent software vendor (ISV)

In payments, an independent software vendor (ISV) is a company whose software helps businesses accept and manage payments, while licensed providers perform the actual processing.

Merchant account

A merchant account is the account a business holds with a payment provider or acquiring bank that lets it accept card payments and receive payouts.

Merchant of record

The merchant of record is the business legally responsible for a sale: it appears on the customer's statement and is responsible for refunds, disputes and compliance.

Network token

A network token is a substitute card number issued by a card network such as Visa or Mastercard, used in place of the real card number and tied to a specific merchant or device.

Payment facilitator (PayFac)

A payment facilitator is a company registered with the card networks to onboard sub-merchants under its own master merchant account and handle their funds flow.

Payment gateway

A payment gateway is the technology that securely sends a customer's payment details from a website or app to the payment processor and returns the result.

Payment link

A payment link is a shareable URL that opens a checkout page for a set or customer-chosen amount, letting a business get paid without a website.

Payment orchestration

Payment orchestration is software that connects a business to multiple payment providers through one integration and decides which provider handles each transaction.

Payment processor

A payment processor is a licensed company that moves transaction data between the merchant, the card networks and the banks so a card payment can be authorized and settled.

PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) is the security standard every business that stores, processes or transmits card data must follow.

Refund

A refund returns all or part of a completed payment to the customer's original payment method, initiated by the merchant.

Sandbox environment

A sandbox is a test environment where developers can build and test payment integrations with test cards and test keys, without moving real money.

Shared Payment Token (SPT)

A shared payment token is a payment provider credential an AI agent obtains from a buyer's wallet that lets one specific seller charge the buyer's payment method, up to a set amount, before it expires.

Tokenization

Tokenization replaces sensitive card data with a random token that is useless if stolen, so systems can reference a payment method without storing the card number.

Webhook

A webhook is an HTTP request a service sends to your server when something happens, such as a payment succeeding, so your system can react without polling.

Webhook signature

A webhook signature is a cryptographic hash, usually HMAC-SHA256, that a sender attaches to each webhook so the receiver can prove it is genuine and unmodified.