PayPal Integration for Your Website: What You Need and What You Should Never Share

PayPal is a familiar way to pay, and many customers prefer it. Connecting it to your site is usually simple, but the way you do it matters for your security.

What you need

• A PayPal Business account in your own name
• A website with HTTPS enabled
• Your product prices, delivery and refund policies

How the connection works

For WooCommerce, PayPal’s official plugin lets you connect by signing in on PayPal’s own page and approving the connection. You enter your password only on PayPal’s website, not on a developer’s computer. Custom integrations use API credentials, a client ID and secret, which you create in PayPal’s developer dashboard. There is also a sandbox environment for testing with fake money.

What you should never share

• Your PayPal login password
• Verification codes sent to your phone
• Security answers and recovery details
• Your bank account or card details

If someone else needs to help

PayPal business accounts allow you to add users with limited permissions. Use that, instead of your own login, for anyone who needs to view transactions or manage settings. Remove them when the work is complete.

Test everything

Use the sandbox or a small real payment to check that orders are created, emails are sent, and refunds work as expected. Confirm what happens when a customer cancels or a payment fails.

Protect the account

• Turn on two-factor authentication.
• Be careful with emails claiming your account is limited. Go to PayPal directly instead of clicking a link.
• Check that the email address on the account is one only you control.

Get help the safe way

We connect PayPal and Stripe to websites without ever needing your password. See our payment integration service, and read about Stripe integration and scams to watch for.