Which PayPal API should I use for payments?

Question

I'm just starting out and have a basic question after reviewing the voluminous docs at PayPal Developer. Which API should I use?

We have a very specific scenario. We are an online database that needs to take subscriptions. We compute the subscription amount by collecting some information from the user, then we need to have the user pay, then we need to activate the subscription. We want to support autorenew for the subscriptions.

Our web site is currently PCI compliant and we need to remain so.

As to solutions: The Subscribe Button approach seems very simple but limited. I assume we can create multiple buttons for the different option scenarios and pass in the amount. How do we get confirmation back to allow subscription activation?

The REST API seems very easy to program in Java (and we have extensive Java expertise) but see "PCI compliant" above. Also, I can't really tell whether the HTTP response to the payment request comes back with payment approval status or whether a redirect URL is required (and hence a payment web app and cross-app checking of response).

The PayFlow API is an older style that I'm familiar with, and the Hosted page approach seems like a good option, but the programming seems a lot more involved.

We'd like to get this solution operational as quickly as possible with as little programming effort as possible, but we do need to maintain PCI compliance.

Have I missed any options? Am I asking the right questions for each solution?

If this is too broad for the forum here, can someone tell me how to ask the question directly to PayPal? Finding a way to do that is apparently more of a technical challenge than using the PayFlow API. :)

Thanks!

Answer 1

The official PayPal api : https://developer.paypal.com/docs/classic/lifecycle/sdks/

Please also look at How to use of pay pal java API

Answer 2

Payflow is a pure gateway, meaning you have your own merchant account.

PayPal Payments Pro is a merchant account and gateway. You can access it either via the REST API, or the Classic API. As of right now, the Classic API has more options to it (there are some API calls that cannot be done over REST) but OAuth is the hot thing and thus you have REST.

In both cases, you make an API call over HTTPS and you send your data behind the scenes and the response tells you if the payment went through or not (along with any error messages). Both also require you to have SSL and maintain minimum PCI compliance (ie don't log CVV2, etc)

I am confused, however. You say your page is PCI compliant but the rest of your post seems to indicate the opposite. Which is the case?