Authorize.net Gateway Only for High-Risk Merchant Accounts

When Jotform widened its Authorize.net integration in July, the form builder’s announcement described two ways to sign up. Businesses without an account “can create an All-in-One account, which includes a payment gateway and merchant account, or select the Gateway Only option if they already have a merchant account,” Jotform wrote in its July 2, 2026 post about deepening its collaboration with Authorize.net, which it describes as a Visa Acceptance Solution.

That second option is the one to read closely for sellers of supplements, hemp products, and other regulated goods. Authorize.net’s sign-up page marks the bundled merchant account as “subject to eligibility.” Gateway Only leaves the underwriting decision with whichever bank already approved the merchant, and lets the website keep talking to Authorize.net.

Two contracts, one checkout

A card payment on a website passes through two separate businesses. The gateway takes the card data from the checkout and passes the transaction along. The merchant account, held with an acquiring bank and usually sold by a merchant service provider (MSP), is what actually approves the business to accept cards and deposits the money. The merchant identification number (MID) that the acquirer issues ties each sale to that approval.

Authorize.net sells both pieces in its All-in-One plan, priced at $25 a month plus 2.9% and 30 cents per transaction. The sign-up page says Authorize.net is a registered independent sales organization (ISO) of PNC Bank, N.A., and that the underwriter looks at factors including industry, processing history, and credit. The FAQ says an All-in-One application could be approved in as little as an hour if it is auto-approved, and that merchant account approval can otherwise take from one to five business days or more, depending on industry, credit history, and responsiveness.

Gateway Only costs $25 a month plus 10 cents per transaction and a 10 cent daily batch fee. Authorize.net’s FAQ on the same page says this plan connects the gateway to a merchant account the business already has “without replacing your existing account.” A merchant that already has an account can enter the parameters from its provider and, in the FAQ’s words, “be ready to transact within minutes.” Deposits then come through the merchant’s own MSP.

Which acquirers can sit behind the gateway

The constraint that matters for a high-risk store is the processing platform. Authorize.net’s support article on merchant account requirements says a Gateway Only customer needs a merchant account from an MSP in the United States or Canada, and lists the North American platforms it connects to.

Chase Paymentech (Tampa)
Elavon
First Data Omaha and First Data Nashville
Global Payments
Heartland
NAB EPX
TSYS
Worldpay (Vantiv Core)

A specialty acquirer that settles on one of those platforms can usually be connected. One that runs on a platform outside the list cannot, however willing its bank is to take the product category. Before a supplement brand signs with a high-risk acquirer, whether it found the bank on its own or through an agent such as Organic Payment Gateways, the platform name belongs on the list of questions next to reserves and rates. The same support article says each Authorize.net account is set to one currency, and it lists only U.S. and Canadian dollars for those platforms.

Authorize.net does not publish an industry list for Gateway Only customers on its sign-up page. Its eCheck support article refers merchants to its Terms of Use for the company’s acceptable use guidelines, so a store in a gray-area category should confirm with Authorize.net as well as the acquirer before building around the connection.

What comes with the gateway and what does not

All three plans on the sign-up page list the same core tools. Automated Recurring Billing (ARB), Customer Information Manager (CIM), and the Advanced Fraud Detection Suite (AFDS) each show no monthly fee. Account Updater, which refreshes stored card numbers, is listed at 25 cents per update. Because those tools live in the gateway account, a Gateway Only merchant gets them no matter which acquirer holds the MID. EC4IM has covered AFDS settings for card testing and Account Updater for recurring billing in earlier pieces.

eCheck is the exception. Authorize.net’s electronic check service moves money over the Automated Clearing House (ACH) network, and Authorize.net underwrites it directly instead of relying on the card acquirer. A support article on applying for eCheck says its underwriting team reviews each application, which can take from a few minutes to about three business days. The same article quotes the eCheck service agreement’s list of excluded businesses, which includes drug paraphernalia, gambling, adult material, computer sales, and import and export, and ends with “any other business type or industry that Authorize.net, at its sole discretion, determines to possess excessive risk.” The sign-up page adds that eCheck is available only to U.S.-based businesses, at 0.75% per transaction with a $10 monthly minimum and a $3 fee per returned item. A merchant whose card MID was approved elsewhere should not assume eCheck will follow.

What the Jotform connection actually stores

Jotform’s setup guide, last updated February 20, 2026, asks for three gateway credentials, the API Login ID, Transaction Key, and Client Key. Nothing about the acquirer goes into the form. The guide lets a form sell products, sell subscriptions, take a customer-entered amount, or collect donations, with an authorization-only setting for orders that ship later. Its currency dropdown offers U.S., Canadian, and Australian dollars, euros, and pounds, but since each Authorize.net account is set to one currency, and the North American platforms list only U.S. and Canadian dollars, the currency picked in the form needs to match the account.

The guide also lists an Emulator setting for EPN, GoEmerchant, MerchantOne, PayJunction, and USAePay, gateways that accept requests in the Authorize.net format. That gives a merchant whose acquirer prefers one of those gateways a way to keep a Jotform payment form.

Switching acquirers without touching the integration

The practical payoff of the split shows up when a high-risk merchant loses or outgrows its acquirer. Authorize.net’s processor change article lays out the process.

The merchant gets a Value-Added Reseller (VAR) sheet from the new MSP. It lists the MID, the statement descriptor, and the merchant category code (MCC).
The account owner or an account administrator files a Processor Update Request support case with the platform details. If a reseller subsidizes the account, Authorize.net refers the change to that reseller.
Most changes finish within one to two days and take effect immediately. Client Services runs a test transaction afterward.
Transactions that were authorized but not yet settled settle with the original processor. Refunds issued after the change go to the new one.

The article answers the developer’s question directly. Asked whether a processor change affects API configurations, it says the change “will not impact your web site or API connections/configuration.” A separate article on data exports tells merchants with multiple accounts that a processor configuration change, not a data extraction, is the way to move profiles. Read together, the two articles indicate that stored CIM profiles stay with the gateway account through an acquirer change, and the form or cart keeps the same credentials. Moving to a different gateway altogether is a bigger job, covered in our piece on CIM and NMI vault migrations.

Where this leaves a regulated store

Every Authorize.net checkout rests on two decisions, one by the gateway and one by the bank behind it. Jotform’s July announcement put the All-in-One account up front, but a supplement or hemp seller is more likely to need Gateway Only, a merchant account from an acquirer on one of the supported processing platforms, and a separate look at eCheck, which Authorize.net approves on its own terms. Recurring billing, stored profiles, and fraud filters stay in the gateway account, and the support documents say a later change of acquirer does not require new API credentials. The open questions to settle before building are the processor platform, the account currency, and whether Authorize.net’s own usage rules cover the product.

How Authorize.net Gateway Only Works With a High-Risk Merchant Account