UAT·Ops About UAT-Ops

PayPal integrations by platform

Sandbox run evidence

UAT-Ops ran the directory's canonical card flow against PayPal's sandbox on 2026-09-11: 5 passed. Every request went to the real sandbox through the workbench's ordinary execution path. Keys, object ids, request and response bodies were removed before publication; the status word in the last column is the provider's own.

StepRequestHTTPLatencyResultProvider status
authorizePOST v2/checkout/orders2012387 msPassstatus=completed
capturePOST v2/payments/authorizations/:authorization_id/capture2011711 msPassstatus=completed
partial refundPOST v2/payments/captures/:capture_id/refund2011697 msPassstatus=completed
authorize for voidPOST v2/checkout/orders2012487 msPassstatus=completed
voidPOST v2/payments/authorizations/:authorization_id/void204695 msPass

Platform pages

About PayPal

PayPal is a payments company whose merchant product, the PayPal Commerce Platform, is used through REST APIs and a JavaScript SDK. Merchants range from stores using the PayPal button to businesses building their own card form with Advanced Credit and Debit Card Payments, which is available in 37 countries. Payflow, PayPal's older NVP/SOAP gateway, is still documented but is a separate product line.

A checkout is an order: you create it with the Orders v2 API, the buyer approves it, and you authorize or capture it. Payments v2 then handles the rest of the lifecycle: capture, void or reauthorize an authorization, and refund a capture in full or in part. Calls are authorized with an OAuth 2.0 client-credentials token, the API version sits in the URL path, and a PayPal-Request-Id header makes POST calls idempotent for 45 days. Webhooks are subscribed per app; each delivery can be verified locally or by posting it back to PayPal's verification endpoint. OpenAPI specifications for the REST APIs are published on GitHub.

Beyond the PayPal wallet and cards, the platform covers Venmo (US only), Apple Pay, Google Pay, Pay Later instalments, a vault for saved cards and wallets, subscriptions, Level 2/3 data and regional bank-redirect and voucher methods. Apple Pay and Google Pay both require Advanced Credit and Debit Card Payments to be enabled first.

Testing is self-serve: registering on the Developer Dashboard creates a sandbox business account with credentials and a personal buyer account, and more can be created on demand. PayPal publishes test cards, decline triggers and 3-D Secure test cards. One thing to check before the first card order: the sandbox app must have card processing enabled under its Features, or orders fail with PAYEE_NOT_ENABLED_FOR_CARD_PROCESSING.

Pricing is a percentage plus a fixed fee per transaction.

What we checked

  • Registering as a PayPal developer automatically provisions a sandbox business account with API test credentials and a default personal account; additional Personal or Business sandbox accounts are created from Sandbox > Accounts in the Developer Dashboard, or bulk-uploaded.1
  • The sandbox is a self-contained virtual environment that simulates production; a PayPal account is used to log in to developer.paypal.com, and some live features such as closing an account or monthly statements do not apply in the sandbox.2
  • PayPal publishes static sandbox test card numbers for Visa, Mastercard, American Express, Diners, Maestro, JCB and CUP, a card generator, case-sensitive CCREJECT-* cardholder-name triggers that simulate declines, and separate 3-D Secure test cards.3
  • Advanced Credit and Debit Card Payments must be enabled on the sandbox REST app under Apps & Credentials > Sandbox > Features > Accept payments; the guide says it should be enabled automatically for a sandbox business account, and if it is not, the sandbox onboarding steps must be completed.4
  • PAYEE_NOT_ENABLED_FOR_CARD_PROCESSING is returned when the payee's account is not set up to receive card payments; the fix is to complete onboarding with card payments included or have PayPal enable card processing on the account.5
  • Sandbox negative testing (in beta) simulates error conditions by request header or test values; it is switched on per sandbox business account under Sandbox > Accounts.6
  • The optional PayPal-Request-Id header enforces idempotency on REST POST calls; the server keeps the ID for up to 45 days so a timed-out or 500 request can be retried without duplicating the action. Sandbox calls go to https://api-m.sandbox.paypal.com and live calls to https://api-m.paypal.com; a PayPal-Mock-Response header triggers error scenarios in the sandbox.7
  • REST calls are authorized with an OAuth 2.0 access token obtained by posting grant_type=client_credentials to /v1/oauth2/token with the app's client ID and secret as Basic auth; the token is sent as a Bearer header and re-requested when it expires.8
  • Orders v2 exposes create order, show, update (PATCH), confirm payment source, authorize, capture and add tracking under /v2/checkout/orders; the API version is carried in the URL path.9
  • With PayPal Checkout the customer selects the PayPal button and pays with any funding source linked to their PayPal account, integrated through the Orders v2 API and the JavaScript SDK.10
  • Payments v2 handles the post-order lifecycle: capture, void and reauthorize an authorization, and refund a capture.11
  • Refunding a capture with an empty JSON body refunds the full amount; including an amount object performs a partial refund. The endpoint also accepts the PayPal-Request-Id idempotency header.12
  • Up to 10 webhook URLs can be subscribed per REST app, to chosen event types or all events; a non-2xx response makes PayPal retry delivery up to 25 times over 3 days, and failed deliveries can be resent from the dashboard.13
  • Webhook messages can be verified locally (CRC32 of the body plus signature check against the certificate at cert_url) or by posting the transmission headers, webhook ID and the exact received payload to /v1/notifications/verify-webhook-signature, which returns a verification_status.14
  • The webhooks simulator posts sample events to an HTTPS listener; mock events are not tied to an app, do not appear in the event viewer, cannot be verified via the postback endpoint, and are self-verified with the fixed webhook ID string WEBHOOK_ID.15
  • Order and payment events include CHECKOUT.ORDER.APPROVED, CHECKOUT.ORDER.COMPLETED, PAYMENT.AUTHORIZATION.CREATED, PAYMENT.CAPTURE.COMPLETED and PAYMENT.CAPTURE.REFUNDED.16
  • PayPal publishes OpenAPI 3.0.3 specifications under an Apache-2.0 licence for Orders v2, Payments v2, Payment Method Tokens v3, Subscriptions v1, Webhooks Management v1 and other REST APIs in its paypal-rest-api-specifications GitHub repository.17
  • Advanced Credit and Debit Card Payments is a merchant-built card form; it is available in 37 countries and 22 currencies, and the merchant must tell payers that PayPal processes the payment.18
  • 3-D Secure on card payments is requested through payment_source.card.attributes.verification.method, either SCA_ALWAYS or SCA_WHEN_REQUIRED, and the response carries a liability-shift indicator the merchant checks before capturing.19
  • Apple Pay through PayPal requires Advanced Credit and Debit Card Payments, the Apple Pay feature enabled in the Developer Dashboard and a registered domain; it is offered in 34 countries and 22 currencies, and sandbox testing needs an Apple sandbox tester account.20
  • Google Pay through PayPal requires Advanced Credit and Debit Card Payments and the Google Pay feature enabled under Apps & Credentials; it covers 36 countries and 22 currencies, and sandbox payments are completed with a personal sandbox login.21
  • Pay with Venmo is limited to US merchants and US consumers paying in USD, supports one-time payments and authorize/capture, and on mobile needs Safari on iOS or Chrome on Android.22
  • Pay Later is PayPal's BNPL offer (Pay in 4, Pay Monthly and country variants) in Australia, Canada, France, Germany, Italy, Spain, the UK and the US; the merchant is paid up front, and it is added to an existing PayPal one-time payment integration.23
  • Alternative payment methods on the platform include iDEAL, Bancontact, BLIK, eps, Trustly, Przelewy24, MyBank, Satispay, Alipay, Boleto Bancario, OXXO and GrabPay; giropay and Sofort were sunset in 2024. No SEPA or ACH debit method is listed.24
  • The Payment Method Tokens API vaults cards, PayPal wallets and Venmo; saving must be enabled under Payment capabilities in the Developer Dashboard, and payments without risk data (FraudNet or Magnes) are likely to be declined.25
  • Merchants enrolled with Expanded Checkout can pass a third-party network token (number, expiry, cryptogram, eci_flag, token_requestor_id) in payment_source.card.network_token; PayPal processes but does not store or create these tokens.26
  • The Subscriptions v1 API manages billing plans under /v1/billing/plans and recurring subscriptions under /v1/billing/subscriptions, including suspend, activate, cancel and transaction listing.27
  • The REST API accepts 24 currencies as three-letter ISO 4217 codes; some (HUF, JPY) take no decimals and some (BRL, CNY) are limited to in-country accounts.28
  • Level 2 and Level 3 data go in purchase_units.supplementary_data.card.level_2 and level_3 on the Orders v2 create call; it is US-only in USD, Visa and Mastercard qualify for both levels and American Express for Level 2, and the values must match the purchase_units fields.29
  • Payflow is PayPal's older NVP/SOAP gateway, still documented; the related Website Payments Pro products are described as no longer actively marketed.30
  • US domestic commercial rates: PayPal Checkout and Venmo 3.49% + $0.49; Pay Later 4.99% + $0.49; Advanced Credit and Debit Card Payments 2.89% + $0.29; plus 1.50% on international commercial transactions and a 4.00% currency-conversion spread on cross-currency payments.31

Sources

  1. https://developer.paypal.com/tools/sandbox/accounts/official documentation · checked 2026-09-11
  2. https://developer.paypal.com/tools/sandbox/official documentation · checked 2026-09-11
  3. https://developer.paypal.com/tools/sandbox/card-testing/official documentation · checked 2026-09-11
  4. https://developer.paypal.com/docs/checkout/advanced/integrate/official documentation · checked 2026-09-11
  5. https://developer.paypal.com/api/rest/troubleshooting/rest_unprocessable_entityofficial documentation · checked 2026-09-11
  6. https://developer.paypal.com/tools/sandbox/negative-testing/official documentation · checked 2026-09-11
  7. https://developer.paypal.com/api/rest/requests/official documentation · checked 2026-09-11
  8. https://developer.paypal.com/api/rest/authentication/official documentation · checked 2026-09-11
  9. https://developer.paypal.com/docs/api/orders/v2/official documentation · checked 2026-09-11
  10. https://developer.paypal.com/docs/checkout/official documentation · checked 2026-09-11
  11. https://developer.paypal.com/docs/api/payments/v2/official documentation · checked 2026-09-11
  12. https://developer.paypal.com/api/payments/v2/captures-refundofficial documentation · checked 2026-09-11
  13. https://developer.paypal.com/api/rest/webhooks/official documentation · checked 2026-09-11
  14. https://developer.paypal.com/api/rest/webhooks/rest/official documentation · checked 2026-09-11
  15. https://developer.paypal.com/api/rest/webhooks/simulatorofficial documentation · checked 2026-09-11
  16. https://developer.paypal.com/api/rest/webhooks/event-names/official documentation · checked 2026-09-11
  17. https://github.com/paypal/paypal-rest-api-specificationscode repository · checked 2026-09-11
  18. https://developer.paypal.com/docs/checkout/advanced/official documentation · checked 2026-09-11
  19. https://developer.paypal.com/docs/checkout/advanced/customize/3d-secure/official documentation · checked 2026-09-11
  20. https://developer.paypal.com/docs/checkout/apm/apple-pay/official documentation · checked 2026-09-11
  21. https://developer.paypal.com/docs/checkout/apm/google-pay/official documentation · checked 2026-09-11
  22. https://developer.paypal.com/docs/checkout/pay-with-venmo/official documentation · checked 2026-09-11
  23. https://developer.paypal.com/docs/checkout/pay-later/official documentation · checked 2026-09-11
  24. https://developer.paypal.com/docs/checkout/apm/official documentation · checked 2026-09-11
  25. https://developer.paypal.com/docs/checkout/save-payment-methods/official documentation · checked 2026-09-11
  26. https://developer.paypal.com/docs/checkout/advanced/3rd-party-token-processing/official documentation · checked 2026-09-11
  27. https://developer.paypal.com/docs/api/subscriptions/v1/official documentation · checked 2026-09-11
  28. https://developer.paypal.com/api/rest/reference/currency-codes/official documentation · checked 2026-09-11
  29. https://developer.paypal.com/docs/checkout/advanced/customize/processing/official documentation · checked 2026-09-11
  30. https://developer.paypal.com/api/nvp-soap/payflow/official documentation · checked 2026-09-11
  31. https://www.paypal.com/us/business/paypal-business-feesvendor pricing page · checked 2026-09-11

Last verified 2026-09-13 · Reviewed by a person 2026-09-14

Integration capabilities, requirements, pricing, availability, and vendor policies may change over time. UAT-Ops documents information based on the authoritative sources and testing available at the time of review.

Where newer information, testing, or vendor documentation materially changes a published claim, UAT-Ops may revise the page to reflect the most current verified information. Readers should confirm time-sensitive requirements with the relevant vendor before making production or purchasing decisions.