Integration Guide

8
Protecting Buttons by Using
Encrypted Website Payments
Using Encrypted Website Payments helps secure payment buttons that you generate or write
manually. Encrypted Website Payments protects the HTML button code that contains pricing
information by encrypting it. HTML button code that you protect by using Encrypted Website
Payments cannot be altered by malicious third parties to create fraudulent payments.
Encrypted Website Payments relies on standard public key encryption for protection. With
public and private keys, you can dynamically generate HTML code for payment buttons and
encrypt the payment details before displaying the buttons on your website. The below table
illustrates the sequence of actions that occur with payment buttons protected by using
Encrypted Website Payments.
TABLE 8.1 How Encrypted Website Payments Works
Website Actions Buyer Action PayPal Action
Generate a public key for the
website, upload it to PayPal, and
download the PayPal public
certificate to the website.
N OTE: Do this action only once,
when you first integrate
Hosted Solution with your
website.
Generate HTML code for a payment
button.
Encrypt the generated code by using
the PayPal public key and then
signing the encrypted code with the
website’s private key.
Publish the signed, encrypted
HTML code for the payment button
to the website
Click the published PayPal payment
button.
Check the authenticity of the data by
using the website’s public key,
which was previously uploaded to
PayPal.
Decrypt the protected button code
by using the PayPal private key.
Redirect the payer’s browser to the
appropriate PayPal checkout
experience, as specified in the
HTML variables of the decrypted
button code.