Four routes into online payment: plugin, hosted page, components, API — and what each one costs in PCI effort
How a shop connects payments technically decides onboarding time, conversion and security effort. An overview of the integration types, the payment method mix in the DACH region and the payment link as a sales channel without a shop.
The short answer
A shop can connect payments in four ways. They differ in effort, design freedom and above all in the scope of the security obligations under PCI DSS. For most small and medium-sized merchants, the hosted payment page or the shop plugin is the right choice; the direct interface only pays off once an in-house development team carries the effort.
The four integration routes
| Route | How it works | PCI questionnaire | For whom |
|---|---|---|---|
| Shop plugin | Ready-made module for Shopware, WooCommerce, Shopify, Magento | usually SAQ A | standard shops, fastest onboarding |
| Hosted payment page | Redirect to the provider's payment page | SAQ A | anyone who does not want to touch card data |
| Embedded components | The provider's fields embedded in your own checkout | SAQ A-EP | shops with their own design, without card data on their own server |
| Direct API | Card data runs via the merchant's server | SAQ D | corporates with their own security organisation |
PCI DSS is the silent cost driver. SAQ A covers around two dozen questions, SAQ D several hundred requirements with an annual audit. Providers also charge 5 to 15 euros a month for PCI compliance if the merchant does not evidence it themselves. Leaving the card data to the provider saves money and liability.
The payment link: selling without a shop
A payment link is a link or QR code generated by the provider, sent via WhatsApp, email or SMS or printed on the invoice. The customer pays on the provider's hosted page. For tradespeople, consultants, studios, pre-orders and deposits, this is the simplest form of online payment — no shop, no integration, the same payment methods.
The payment method mix in the DACH region
For Germany: card, PayPal, SEPA direct debit, invoice purchase (in many ranges the most popular payment method) and instalment purchase. For Austria, additionally eps bank transfer, which more than 11,000 shops offer, and Bluecode. giropay was discontinued at the end of 2024; any checkout page still showing it is out of date. Its successor is Wero, live in German online retail since November 2025 and supported by Payone, VR Payment, Unzer, Nexi, Worldline and Stripe.
The mix is not a question of completeness. Every payment method has its own costs (card around 1.8 per cent plus a fixed amount, direct debit a matter of cents, invoice purchase with cover several per cent) and its own reversal risk. The order in the checkout steers what customers choose.
Omnichannel: one contract for shop floor and web shop
Anyone running both a shop floor and an online shop should keep both with one provider, in one contract, one statement and one portal. That enables click & collect, ordering in store with delivery to the home, cross-channel returns and Tap to Pay on the smartphone as a supplement to the terminal. Separate providers for till and shop mean double administration, a double fee structure and no shared view of the customer.
What to do
- Choose the integration route by PCI effort, not by design freedom; SAQ A is right for most merchants.
- Sort payment methods by cost and risk and arrange them accordingly in the checkout.
- Remove giropay, assess Wero.
- Bring terminal and online together with the same provider, if the terms are right.