Paypal的Payment REST API调用的随机信用卡数据

Question

Has anyone yet dabbled with Paypal's REST API call for Direct credit card payments ?

This resource resides here:

https://api.sandbox.paypal.com/v1/payments/payment

The typical way to process this account is:

1. Get access token by making an API call that includes the Client_ID and Secret.
2. Using the access token, I make a call to the payment API with the necessary card specific data.

In point number 2, the line 'necessary card specific data' is important. So far, I had been testing using one of my test/sandbox business accounts. That is, the credit card data that was specifically generated for this account. However, it seems like I can manipulate the name, change the expiry date (as long as it's a valid date), the CVV2 number. As long as the credit card passes a MOD 10 check, the response object shows the payment as processed (state: approved) .

My question is, is this a loophole (unlikely) or just by design that paypal allows any random card related data to verify payments. (as long as they are valid credit card numbers).

If it is the earlier, then I wonder why Paypal wants me to create a business account and generates credit card data for me, when all I really need is the REST API client id and secret that is provided when I sign up as a developer.

Disclaimer: The documentation does not state anywhere that random card related data can be used.

Answer 1

Correct, this is by design. We'll accept any credit card number in the Sandbox environment as long as it adheres to MOD-10. This is done specifically to allow for easier testing in the Sandbox environment.

If it is the earlier, then I wonder why Paypal wants me to create a business account and generates credit card data for me, when all I really need is the REST API client id and secret that is provided when I sign up as a developer.

I'm not quite sure what you mean here though?