PayPal

Overview

Connect your users to PayPal for payment processing, account information, and financial transaction data.

Property	Value
Provider ID	paypal
Category	Payments
PKCE	Supported
Token refresh	Automatic
Environments	Production and Sandbox
Redirect URI	Shown in Developer Portal

Sandbox vs production

PayPal runs its sandbox on different OAuth endpoints, not just different API hosts. A sandbox client ID and secret are valid only against the sandbox, and live credentials only against production — they are not interchangeable.

Pick the environment when you configure the provider:

• Developer Portal — an Environment selector appears on the PayPal configuration form.
• CLI — pass --environment sandbox:

alter providers create --app <app> --provider paypal \
  --environment sandbox \
  --client-id <sandbox-client-id> --client-secret - \
  --scopes openid,email \
  --redirect-uri https://your.app/callback

PayPal client IDs are opaque — there is no documented format difference between sandbox and live IDs. The save-time credential check verifies the credentials against the environment you selected, so a credential that belongs to the other deployment is rejected with an explanation at save time rather than failing later at the first user connection. A sandbox configuration can only reach api-m.sandbox.paypal.com; it cannot call the live API.

Going live

Switch the existing configuration rather than deleting and rebuilding it. Change the environment and the credentials together — sandbox and live credentials are not interchangeable:

alter providers update --app <app> --provider paypal \
  --environment production \
  --client-id <live-client-id> --client-secret -

In the Developer Portal, the Environment selector is on the provider’s configuration page, next to the client ID and secret.

Warning

Switching environments invalidates every existing grant for the provider. The stored tokens were issued by the deployment you are leaving and are not valid against the new one, so all users must reconnect through Alter Connect. The response lists this as a breaking change.

Step 1: Create a PayPal OAuth App

Go to the PayPal Developer Dashboard

Navigate to developer.paypal.com/dashboard/applications and sign in.

Create a new app

Click Create App, enter an app name, and select Merchant or Platform as the app type.

Configure the redirect URI

Under App Settings, add the Alter callback URL from the Developer Portal to the Return URL field.

Get credentials

Copy the Client ID and Client Secret.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add PayPal provider

Go to OAuth Providers > Add Provider > PayPal.

Enter credentials

• Client ID: Paste your PayPal Client ID
• Client Secret: Paste your PayPal Client Secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
openid	Access to OpenID Connect identity
email	Access to user email address
profile	Access to user profile information
address	Access to user address information
https://uri.paypal.com/services/paypalattributes	Access to PayPal account attributes

Additional scopes

Scope	Description
https://uri.paypal.com/services/expresscheckout	Process Express Checkout payments on behalf of the account
https://uri.paypal.com/services/payments/futurepayments	Charge the customer for future payments (Future Payments)
https://uri.paypal.com/services/wallet/sendmoney	Send money from the account’s PayPal wallet

Notes

• PayPal has separate sandbox and production environments. Use sandbox credentials for development.
• See the PayPal Log In with PayPal documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
orders.create	payment, write	POST	/v2/checkout/orders
orders.get	read	GET	/v2/checkout/orders/{id}
orders.patch	payment, write	PATCH	/v2/checkout/orders/{id}
orders.authorize	payment	POST	/v2/checkout/orders/{id}/authorize
orders.capture	payment	POST	/v2/checkout/orders/{id}/capture
orders.confirm	payment	POST	/v2/checkout/orders/{id}/confirm-payment-source
orders.track.create	write	POST	/v2/checkout/orders/{id}/track
orders.trackers.patch	write	PATCH	/v2/checkout/orders/{id}/trackers/{tracker_id}