User's Manual

Backend Integration - Payment Notifications
Instant Payment Notification (IPN)
12
106 May, 2005 Merchant User Manual and Integration Guide
Setting Up IPN
To set up IPN:
1. Log in to your Business or Premier PayPal account.
2. Click the Profile subtab.
3. Click the Instant Payment Notification Preferences link in the Selling Preferences
column.
4. Click Edit.
5. Click the checkbox and enter the URL at which you would like to receive your IPN
Notifications.
6. Click Save.
Alternatively, you can activate IPN by including the notify_url field in your PayPal
button. This field specifies the URL of a script that can process the IPN.
For a complete list of IPN fields, variables, and sample code, see “IPN and PDT Variables” on
page 145. Code samples for the following development environments is also available on the
PayPal website at
http://www.paypal.com/cgi-bin/webscr?cmd=p/xcl/rec/ipn-code-outside:
z ASP.Net/C#
z ASP/VBScript
z Cold Fusion
z Java/JSP
z PERL
z PHP
Notification Validation
Once your server has received the Instant Payment Notification, you will need to confirm it by
constructing an HTTP POST to PayPal. Your POST should be sent to
https://www.paypal.com/cgi-bin/webscr. This post-back of the IPN data to a secure PayPal URL
(i.e., https://) prevents 'spoofing,' so you can be sure that the IPN came from PayPal.
NOTE: It is possible to implement IPN without SSL (i.e., http://), but then the IPN data that is
received and posted back is not secure.
You must post all of the form variables you received exactly as you received them. You will
also need to append a variable named cmd with the value _notify-validate (e.g.,
cmd=_notify-validate) to the POST string.
PayPal will respond to the post with a single word, “VERIFIED” or “INVALID,” in the body
of the response.
When you receive a VERIFIED response, perform the following checks: