Paypal iOS SDK for use with Paypal tokens

Question

Building an iOS app that needs to integrate payment with Paypal . However, my server side developer is providing me with a paypal token and URL as a way of allowing the user to make the Paypal payment.

Do any of the native Paypal iOS SDK's provide a method of supplying a token (EC-3789302FDS280352 style token) to allow the user to complete payment? Or do I have to use a WebView for this?

Answer 1

Is the server-side developer providing you with an endorsed token (ie one that the user has accepted via the web flow) or an unendorsed token (just the result of a SetExpressCheckout() call alone)?

If the former, you can complete a payment via DoExpressCheckout from anywhere, including iOS, pretty easily; it's just an https API.

If the latter then you need to send the user through the ExpressCheckout web flow, and that means Safari outside your app, NOT a WebView. At least in the past PayPal has forbidden (per their legal terms) putting a PayPal web payment flow inside a WebView inside an app because it lacks any "chrome" (URL bar, etc) to allow a user to check that they have a secure connection directly to PayPal & that their credentials cannot be intercepted by the app or anyone else.

PayPal is relaxing these requirements somewhat over time, but they are not focused on/interested in people using the older ExpressCheckout flows inside apps. So if you build that way you could be summarily turned off by PayPal. (Not to mention that Apple may take issue with collection of funds in an app not via iTunes/Apple Pay). And you would very likely be denied any protection policy claims.

I would recommend that you either build your flow so that users provide payment credentials before coming to the app and the app only sees an endorsed EC token or (better) a billing agreement token, or that you look into something like the Braintree v.zero SDK that more readily covers both web-based and in-app credential collection, and will have PayPal's blessing (and security functions designed for) both checkout environments.