I think this is how it goes:
Banks/credit card companies have their payment APIs[0] open to parties they deal with (usually) payment gateways(now don't ask me for public methods and web service URIs) ->> payment gateway firms[1] deal with the banks and have access to those APIs ->> merchants/sellers[1] deal with payment gateways ->> customer checks out on seller/merchant's website ->> is redirected to (usually) payment gateway's portal where basic card/account credentials[2] are entered ->> is redirected bank/card's secure authentication page[3] ->> user enters login/password ->> is redirected back to seller/merchant's page with success/fail message.
[0] You might have to get in touch with some bank and/or payment gateway.
[1] When the seller is big, sometimes, they are themselves the payment gateways. Some PG examples are Citrus, Billdesk, SBI,CCAvenue(the shittiest) etc.
[2] Here in India the basic credentials include card number, exp date, name, CVV. In the USA these same basic details are more than enough for final purchase - sometimes even minus the cvv.
[3] Usually Mastercard's NetSafe or Verified By Visa etc.