Paypal /Permissions/GetBasicPersonalData fails randomly with "Authentication failed. API credentials are incorrect."

Question

I'm using paypal permissions api to authenticate user through paypal and get some permissions.

The problem is that sometimes the /Permissions/GetBasicPersonalData call returns "Authentication failed. API credentials are incorrect." even though I got the token and secret from a successful call to /Permissions/GetAccessToken

The weird thing though is that it is very unpredictable. It is sometimes fails and sometimes work with the sandbox, always fails on production (live paypal).

When it works it seems to work every time, when it fails it starts failing every time, that is until it changes.

Answer 1

Paypal is doing some custom encoding and string manipulations while generating OAuth signature, for example, it will encode . to %2E first and it will be later on converted to lowercase string %2e.

If you are writing your own Paypal OAuth signature generation function and you missed some the the steps, your signature will be invalid. The "random" thing that you described is probably because those special characters are not guaranteed to show up in token/token secret. When they are not there, it will success and vice versa.

I made it work by translating bit-to-bit from Paypal's official Ruby SDK. (https://github.com/paypal/sdk-core-ruby/blob/master/lib/paypal-sdk/core/util/oauth_signature.rb)