I've researched both paypal and authorize.net pretty thoroughly. For starters, I ended up with authorize.net. To first compare features though: Paypal offers wh

I've researched both paypal and authorize.net pretty thoroughly. For starters, I ended up with authorize.net. To first compare features though: Paypal offers what I believe they call the "paylink" feature. This is where the user is redirected to a paypal site (off of your own website) to make their purchase. The good thing about this for retail driven commerce is that it will interface well with a shopping cart system. I believe it either has no monthly charge or a very minimal one (also you won't need your own SSL). Above this, both companies have an API (or an application programming interface). To use Paypal's API you need to subscribe to their "payflow pro" program. This is about $40-50 mo. Authorize.net has API integration for about $30 I think. But then you need a merchant bank account which you can get through them for another $10. For those who aren't familiar, through an API you can set up a payment system that is built into your own site, which relays the data to the payment gateway. This is obviously the best option for serious merchants of any kind. When accepting credit cards you'll also need a SSL (Secure Socket Layer) or in other words a secure connection (https://). I think they will actually allow you to use their api without that but it's definitely a horrible idea. There are a few major providers of this service, and they range in price significantly. www.InstantSSL.com or "Comodo" as they call themselves, has a pretty decent mid range SSL encryption package for about $100 a year. Godaddy.com has one that's like 19.99 or something ridiculous. The issue with SSL providers is simple. You can bet that they are all perfectly secure. The issue is really in browser recognition. The worst thing ever for an online merchant is to loose credibility, and what's the fastest way to appear disreputable - ""this site may not be secure, internet explorer recommends that you leave it immediately" or what ever that error says. This happens when a browser doesn't recognize the security certificate. To be safe, go with a provider that you can guarantee is trusted by all the major browsers (even old versions). Also - one last piece of advice. When subscribing for a SSL certificate make SURE to turn your domain anonymity off temporairly while you subscribe. Otherwise they'll put you through an endless "verification" process that involves multiple faxes and endless bureaucracy!!!