Why do I keep getting a 403 forbidden with PayPal?

Question

I integrated with PayPal using the HTML Forms method for accepting payments on my website. When a user selects PayPal as a payment option on checking out, I redirect them to the PayPal website using HTML Forms as described in the documentation. I do receive the payment to my PayPal account, however my on receiving the IPN message to my notify_url when I send the notify-validate command I get the error: 403 forbidden. Please assist. Everything is working as it should in sandbox but I start getting this error 403 forbidden.

Dogmatist

You are getting 403 which means that you are not authorized. Have you changed your credentials to use the live credentials from PayPal developer portal? Sandbox and live have different credentials. – Adan

from the documentation, paypal does speak of changing credentials and all. but on implementation of the html forms and ipn processing, there's nowhere it speaks of sending my username and password. i only send back the IPN that im sent by PayPal. May you advise how i can send the live credentials to authenticate my IPN response. – Dogmatist

Answer 1

Try passing a "User-Agent: XXXXXXXXXXXXXXXX" HTTP header in your notify-validate request, where XXXXXX.. is any string > 5 characters

edit: newer documentation on this point

Referendum

interesting idea,will try that and advise. – Dogmatist

Preston, thank you very much. this has worked. I'm surprised how they haven't emphasized on this point in their documentation, yet its a problem that brings the whole system down. – Dogmatist

@PrestonAlexander how can I pass the user-agents you mention in here? – Streamway

Depends on your environment. See here for curl calls in PHP: https://mcmap.net/q/79940/-php-curl-custom-headers – Referendum

@PrestonAlexander Thanks a ton! This resolved the issue for me, but why? Is there documentation at PayPal about requiring this in certain circumstances? I'm using the PayPal Framework plugin for WordPress (github.com/aaroncampbell/paypal-framework) to handle IPN transactions, and this appears to be an isolated issue AFAIK. – Nancinancie

it's part of the requirements explained here developer.paypal.com/docs/api-basics/notifications/ipn/… – Scorpius