[solved] Paypal Instant Payment Notifications - do they still exist?

[cclaerhout]

Paypal modified his layout and I can't find anymore the options to enable IPNs ; could someone confirm please ? If so, may be this XenForo help page could be updated (https://xenforo.com/help/user-upgrades/), same thing for the phrase related to this.


Edit: yes they still exist, they are not in the settings tab but in the sell tab.

 

[digitalpoint]

You don't need to configure anything in your PayPal account. There is a place in your PayPal account for IPN notifications, but it doesn't apply to XenForo user upgrades because XenForo uses the "notify_url" parameter with each transaction, which overrides whatever your default IPN settings are in your PayPal account.

https://developer.paypal.com/docs/classic/paypal-payments-standard/integration-guide/formbasics/

PayPal posts HTML FORM variables to a program at a URL you specify. You can specify this URL either in your account profile or with the notify_url variable on each transaction. This post is the heart of IPN. Included in the notification is the payment information, such as the payer's name and the amount paid. All possible variables in IPN posts are detailed in the Instant Payment Notification Guide. When your server receives a notification, it must process the incoming data.

 

[cclaerhout]

@digitalpoint
That must be this info @xfrocks tried to explain me once ^^

Thanks a lot for your explanation and for the provided documentation.

 

[Parsnip]

Just looking into this here, why I'm seeing unrelated errors in the User Upgrade Transaction Log.

I have the IPN set up in my Paypal account and it seems any transaction made through the Paypal account, even unrelated to XenForo, is sending notifications to the forum and showing up in the log.

From what I can can gather in this thread and elsewhere, as long as the notify_url is sent then there's no requirement for the IPN to be set in the Paypal account.

I can see that notify_url is being set the account_upgrades template.

So could we please have some official clarification about whether or not we must have the IPN set up in Paypal set for User Upgrades to work. The wording in the ACP and on the help page indicate that it is essential, when it seems it's not. Removing the requirement, or suggesting it's optional, would be helpful for those who may way to run multiple forums or other online stores through the same Paypal account.

Has anybody tested it without the IPN set, and are there any potential problems that might occur?

This is the primary email address on your PayPal account. If this is incorrect, payments may not be processed successfully. Note this must be a PayPal Premier or Business account and IPNs must be enabled. Please see our help.

In order to receive payments for User Upgrades, you must have a Premier or Business PayPal account. You must enable Instant Payment Notifications (IPNs) in PayPal under your Selling Preferences. You should enter a notification URL of [your Board URL]/payment_callback.php.

 

[Mike]

Unless PayPal has changed things, IPNs are never sent unless you have enabled them in your account, regardless of any notify_url value being passed in.

If you must, you may be able to set your PayPal IPN URL (within PayPal) to any URL which will respond with a 200 OK-level response as the notify_url will override that. I presume PayPal will still pass refund or chargeback notifications through to the correct/related notify_url. That's something that I'm not positive of off the top of my head (so if you do that, be vigilant of those).

 

[Jake B.]

You don't need to configure anything in your PayPal account.

You have to enable them, and some accounts require that you input a URL but the notify_url set in the form will still work IIRC

Edit: Didn't see Mike's post

 

[digitalpoint]

Unless PayPal has changed things, IPNs are never sent unless you have enabled them in your account, regardless of any notify_url value being passed in.

Actually, the account-level IPN setting doesn't need to be set (and never has needed to). I've never enabled IPN notifications at my account level, and I most certainly have gotten IPN notifications for the last 10 years just fine.

While it certainly doesn't hurt, it's not necessary if the notify_url is being set. This is why my setting looks like:



There is a lot of incorrect information out there with people saying it needs to be enabled at the account on places like StackOverflow, but it's absolutely not the case.

Developer docs from PayPal's website: https://developer.paypal.com/docs/classic/ipn/integration-guide/IPNSetup/

Note: The IPN message will always be sent to your notification URL unless receiving IPN messages has been disabled. Even though you have not enabled receiving IPN messages in your Profile or you have reset your preference by turning off IPN messages, PayPal still sends IPN messages to the notification URL you specify for a specific payment. IPN messages not sent because you disabled the preference in your Profile will appear in the IPN history when you enable receiving IPNs. After they appear in the history, you can choose whether to resend them.

Even that part of the docs seems to say two different things until you realize "notification URL" is what they call the account-level one, and "notification URL you specify for a specific payment" is using notify_url.

Either way, it's not necessary to enable it at the account-level.

 

[Parsnip]

Interesting to know, thanks for the replies.

I currently have the PayPal IPN URL set and enabled within PayPal because this is what I understand the instructions quoted above saying what we "must" do to make it all work.

So I'd love to be able to disable it and stop getting errors like "Unknown Upgrade - Error: Invalid item (custom)" every time someone unrelated to the forum sends me money.

If it's not required then the help and ACP should probably be re-worded to state it's unnecessary or optional.

I presume PayPal will still pass refund or chargeback notifications through to the correct/related notify_url. That's something that I'm not positive of off the top of my head (so if you do that, be vigilant of those).

I did wonder about that too.

 

[Mike]

While I don't doubt @digitalpoint's experience here, equally I feel like we've had numerous reports of IPN messages not being sent and the common denominator has generally been them not being enabled in PayPal.

As such, I would generally say that our official position will always be to enable IPNs in PayPal directly. It may not be necessary in all cases so if your case differs, you could approach it differently but that won't really be the official recommendation.

 

[Parsnip]

OK, fair enough... perhaps re-word 'must' to 'recommended' then.

I just ran a test with IPN disabled in Paypal and an account upgrade went through fine. I then refunded the transaction via Paypal and the account was downgraded again in XenForo.

So I think I'm going to leave it disabled and keep an eye on things, if I encounter any issues I'll report back.

 

[digitalpoint]

While I don't doubt @digitalpoint's experience here, equally I feel like we've had numerous reports of IPN messages not being sent and the common denominator has generally been them not being enabled in PayPal.

As such, I would generally say that our official position will always be to enable IPNs in PayPal directly. It may not be necessary in all cases so if your case differs, you could approach it differently but that won't really be the official recommendation.

Actually, after you said that it reminded me of an *old* bug (like more than a decade) where PayPal IPNs were being incorrectly suppressed on their end by an internal flag on the PayPal account. Toggling the account-wide IPN reset that internal PayPal account flag. I thought they fixed that, but maybe it's still an issue...

If you want to test it, next time someone says something about it, have them toggle the account IPN on (and save that) and then back off and see if they start going through. So it might be an issue with accounts that have that internal flag set. If that's still the case, PayPal is pretty slow and fixing their bugs. haha

 

[Xon]

FYI, IPN notifications require https as of 2016-09-30 and http notification will no longer be supported. (FAQ entry)

 

[Mike]

FYI, IPN notifications require https as of 2016-09-30 and http notification will no longer be supported. (FAQ entry)

Just to clarify, this appears to specifically relate to doing postbacks to PayPal to validate the message. XenForo has used HTTPS for this for as long as I can remember--since day one I think--so I don't think there's any change necessary there. (Though they are recommending ipnpb.paypal.com so we will look at changing to that.)

 

[Sadik B]

@digitalpoint While what you say is true, a lot depends on which paypal api you are using. XenForo uses the form submissions in their user upgrades (it's called "Website payments" IIRC) and the notify_url passed in the payment form does the trick. IF the notify_url is set, it doesn't matter if the account level IPN url is set or not.

However if you use NVP API, notify_url can not be set through the API for the CreateRecurringPaymentsProfile API call.

This creates the unhappy situation where you have to have the account level IPN url set if you want to use their NVP api to create recurring payment profiles.

 

[sross]

Im still slightly confused about this. I currently set my IPN to:

/forum/payment_callback.php

I'm having no issues but do see non-forum payments showing up in my transaction log (I don't really care). So should I leave it as is or "Turn off IPN" ? I'm getting mixed signals here. I do use siropu's ad manager with recurring subscriptions so don't know if that requires the IPN.

Anyway, what is the bottom line? Have it enabled or disabled and do I have the correct url?

thanks

 

[Chris D]

Have IPN enabled but leave the URL blank.

In terms of user upgrades, we specify the notify URL as part of the purchase so there's no need to specify that URL manually.

 

[sross]

Have IPN enabled but leave the URL blank.

In terms of user upgrades, we specify the notify URL as part of the purchase so there's no need to specify that URL manually.

Makes sense however paypal errors out when attempting this:

You must enter a properly formatted URL into the Notification URL field in order to activate Instant Payment Notification.

 

[sross]

also, i can't even disable ipn, then when trying to reenable it:

Sorry, that URL won’t work. Please enter an “https” URL.

 

[sross]

looks like paypal ipn must now have https, on trying to re-enable it they deny my url as it's not https. So as of now my IPN is disabled. I will try an upgrade test and see if it still works.

*update, my test with no IPN worked fine and account was upgraded, guess I'll leave it as is.

 

[Chris D]

Yeah I forgot. Strangely the IPN being on or off doesn't actually make any difference.

An odd system, to say the least...