How to Avoid Handling Credit Card with Paypal

Question

I do not wish to send my customers to Paypal but I also do not wish to transmit the credit card information to my server.

I am looking for the correct/specific API that uses JavaScript to send the credit card information with PayPal and receive a token that I can send to my server to process a payment.

The server-side is very comfortable because I have access to the REST API docs.

But, I simply cannot find any documentation for the JavaScript part that sends credit card info directly to PayPal servers from the customer's browser without involving my servers.

Answer 1

Assuming there was such a way, you would expose yourself to all sorts of problems because you would have to pass your API keys to the client, who could then run anything against your account that they wanted (i.e. I could place an order and then issue myself a refund). In short, you would lose control over a process you literally cannot afford to lose control over.

The only way to process credit cards without processing the card information itself is to use a service that hosts their own checkout process. PayPal Payments Standard is one such service but there are others. You will basically sacrifice control for not having to be PCI complaint, which is a business decision only you can make.

Answer 2

The closest thing PayPal offers is the latest iteration of PayPal Payments Advanced.

Unlike Stripe or Braintree, you have limited control over presentation; basically it just vomits a standard PayPal checkout flow into the middle of your page. You also do not have ultimate control over checkout flow—allowing PayPal Express Checkout is mandatory, and BillMeLater is always offered.

This is unlikely to change in the future as PayPal is a consumer-direct payment processor and finds the strength of their brand to have substantial value.

If you have some strong reason you want to use PayPal for non-PayPal payments, that's your option. Otherwise for standard card processing, the prices are lower, the support is better, and things are substantially more flexible at Stripe and Braintree.

Answer 3

I'm currently in the same situation as you, and have been trying to get all of the PayPal offerings straight.

Payments Advanced - Allows you to use the embedded form during checkout, and all credit card information is processed by PayPal. After a successful payment you can specify a success URL that gives you the payment confirmation. The one drawback here is that you wouldn't be able to process the payment at a later time - it would happen as soon as the user enters their information into the embedded form.

Payments Pro - Most flexible, but in this case you would be transmitting credit card information, and thus PCI compliance becomes necessary. I really wanted to use this solution if only PayPal provided an embedded form where a user could store their credit card information and return a token.