How to connect PayPal to your ecommerce website
Creating the app, finding the right two values, and understanding the capture step that decides whether your customer is actually charged.
The short version: create an app in your PayPal developer dashboard, copy its Client ID and Secret from the Live tab, and give them to your store. The one concept worth understanding before you start is that PayPal separates approving a payment from taking it — and getting that wrong is how stores end up with approved payments they never collected.
TL;DR
- • You need a PayPal business account, then an app created in the developer dashboard.
- • Two values: Client ID and Secret. Take them from the Live tab, not Sandbox.
- • Live and sandbox credentials are not interchangeable and will not work against each other.
- • PayPal authorises on their page and captures when the buyer returns. No capture, no money.
- • PayPal wants amounts as decimal strings, and validates that items plus shipping minus discount equals the total exactly.
Step 1 — Create the app
- Sign in at developer.paypal.com with the PayPal account that should receive the money. This matters — an app created on the wrong account sends payments to the wrong place.
- Open Apps & Credentials.
- Switch to the Live tab. The page usually opens on Sandbox, and this is the single most common mistake.
- Click Create App, name it something you will recognise, and create it.
- Copy the Client ID, then click Show under Secret and copy that too.
Live and Sandbox are separate worlds. Sandbox credentials only authenticate against PayPal's sandbox API, and live credentials only against the live one. There is no mode where the two mix. If you connect one and configure the other, it will fail — which is the correct behaviour, because the alternative is a store taking orders that never settle.
Step 2 — Understand authorise vs capture
This is the concept that separates a working PayPal integration from one that quietly loses money, and almost no setup guide mentions it.
When a customer approves a payment on PayPal's page, nothing has moved yet. That is an authorisation. The money leaves their account when your store captures it, which happens when they return to your site.
The consequence: if a customer approves and then closes the tab, they were not charged and you have no order. That is PayPal's design, and it is why PayPal is the one gateway where a webhook cannot rescue an abandoned return — there is nothing to rescue, because no money moved.
It also means a broken return URL is not a cosmetic bug. It is the difference between being paid and not.
Step 3 — Connect it to your store
If you built the site yourself
Three API calls: exchange the Client ID and Secret for an access token, create an order, and capture it on return. PayPal's REST Orders v2 API is small enough that you do not need their SDK for this.
Two things that will bite you. PayPal wants amounts as decimal strings at the currency's own precision — "14.99", but "1200" for JPY, which has no minor unit. And PayPal validates the breakdown: item totals plus shipping minus discount must equal the order total to the cent, or it rejects the whole request. If you charge a COD-style handling fee, it has to travel inside one of those buckets rather than as a phantom extra line.
Use an idempotency header on both create and capture. Retrying a create without one is how a single sale becomes two PayPal orders.
If you are on a plugin-based platform
Install the official PayPal plugin, paste the same two values, and check it targets the current Orders v2 API. Anything still on the old Express Checkout flow is running on borrowed time.
If you are on a builder that supports it
Paste two values, tick a box. On SitesPlaced, PayPal lives under Settings → Payments & invoices: paste the Client ID and Secret, choose Live or Sandbox, and the credentials are verified with PayPal before anything is saved. The capture step, the amount formatting and the breakdown arithmetic are already handled.
Step 4 — Test in sandbox first
PayPal's sandbox is genuinely good and worth using. It gives you fake buyer accounts with fake balances, so you can run a complete order — approve, return, capture, confirm — without moving a rupee or a cent.
Then do one real order for the smallest amount you can, and refund yourself. Check three things:
- • The order shows as paid with the PayPal capture id recorded against it.
- • The amount matches your PayPal account exactly, including any shipping or discount lines.
- • Approve on PayPal and then close the tab instead of returning. Confirm no order was created and nothing was charged — that is the behaviour you want, and knowing it first-hand saves a confusing support conversation later.
The errors you are most likely to hit
| Symptom | Usual cause |
|---|---|
| Credentials rejected with a 401 | Sandbox credentials used against the live API, or the reverse. Check which tab you copied from. |
| PayPal rejects the order as invalid | The breakdown does not add up. Items plus shipping minus discount must equal the total exactly. |
| Customer approved but was never charged | The capture step never ran — usually a broken or blocked return URL. |
| One sale, two PayPal orders | A retried create call without an idempotency key. |
| Amount rejected for JPY or KWD | Hardcoded two decimal places. Not every currency has them. |
If you do not have the website yet
Everything above assumes you have a store to connect PayPal to. If you are still selling over DMs, the gateway is the easy half.
A SitesPlaced store is free to build and publish, and PayPal, Stripe, Razorpay, PhonePe and Cashfree are all on the free plan with 0% commission — the gateway's own fee is the only cut anyone takes. Connect PayPal for overseas buyers and an Indian gateway for domestic ones, and the customer picks at checkout.
Step-by-step with exact paths: connect PayPal.
Frequently asked questions
Where do I find my PayPal Client ID and Secret?
At developer.paypal.com under Apps & Credentials. Make sure you are on the Live tab, not Sandbox, then open your app. The Client ID is shown; the Secret is behind a Show link.
Why do my PayPal credentials keep getting rejected?
Almost always because they are sandbox credentials being used against the live API, or live credentials against sandbox. The two are completely separate and the page opens on whichever tab you used last.
A customer approved the payment but I have no order. What happened?
PayPal separates approving from capturing. Approving authorises the payment; the money only moves when your store captures it, on the customer's return. If they closed the tab on PayPal's page, nothing was charged. Ask them to order again.
Do I need a PayPal webhook?
For the basic checkout flow, no — the capture happens on return and that is the moment money moves. Webhooks matter for disputes and refunds initiated inside PayPal, which most small stores handle manually.
Does PayPal work for Indian merchants?
It works differently in India and is aimed mainly at receiving payments from abroad. For Indian customers paying in rupees, use Razorpay, PhonePe or Cashfree — they support UPI, which is what most Indian shoppers prefer.
Skip the integration work entirely
Build the store free, paste two values, tick a box. PayPal, Stripe, Razorpay, PhonePe and Cashfree are all on the free plan at 0% commission.
