A Braintree integration has two sides that work together: a client-side piece (the SDK running in your app or site, through Drop-in or Hosted Fields) that collects payment details and turns them into a secure, single-use token, and a server-side call that takes that token and actually runs the transaction. Neither side touches raw card data directly once Drop-in or Hosted Fields is doing the work, which is exactly why Braintree built it that way.
Drop-in gets you a working, styled payment form with the least amount of code, including Braintree's own saved-payment-method UI. Hosted Fields trades some of that convenience for full control over how each field looks, while the actual card input still lives inside a Braintree-controlled iframe behind the scenes. The GraphQL API is a newer option sitting alongside the original REST API, useful if your team already prefers GraphQL's single-endpoint, ask-for-what-you-need style.
Every integration gets built and tested against Braintree's sandbox first, a separate environment with its own test credentials and documented test card numbers, before it ever touches a live merchant account.