How can I verify a PayPal REST webhook?

Use the stored Webhook ID, raw body, transmission headers, and certificate to verify it locally, or submit the unchanged event and header values to PayPal's verify-webhook-signature endpoint.

How can I verify a PayPal IPN message?

Post the exact message back to PayPal over HTTPS with `cmd=_notify-validate` before the original fields. Keep the order and encoding intact, and accept the business event only after a `VERIFIED` response and transaction checks.

Why did PayPal send the REST webhook again?

PayPal retries when the listener cannot be reached or does not return 2xx. Its documented policy allows up to 25 attempts over three days.

Should I block PayPal callbacks with robots.txt?

No. Robots.txt is not consulted for configured webhook or IPN endpoints. Remove an unused subscription or listener, and reject invalid requests at the endpoint or firewall.

Do PayPal callbacks affect AI search or training?

No. They report account and transaction events to merchant systems. They do not retrieve public content for an AI index or training corpus.

PayPal: What It Is & How to Handle It

What is PayPal?

PayPal REST webhooks post JSON notifications to an HTTPS listener subscribed under a PayPal app. The subscription selects event types such as completed captures, refunds, or subscription changes, and PayPal assigns a Webhook ID to the listener. That ID is part of message verification even though it is not included in the callback headers or body.

REST webhook deliveries carry transmission ID, transmission time, certificate URL, algorithm, and signature headers. A receiver can verify the signature locally with PayPal's certificate and a message built from the transmission values, Webhook ID, and CRC32 of the raw body. It can instead send the unchanged event and headers to PayPal's verify-webhook-signature API.

This catalog entry can also match PayPal Instant Payment Notification traffic. IPN is a separate, older protocol and does not use the REST webhook signature flow. An IPN listener acknowledges the POST, then sends the complete message back to PayPal over HTTPS with cmd=_notify-validate before the original fields. PayPal returns VERIFIED or INVALID, after which the listener still checks transaction status, recipient, amount, currency, and duplicate transaction IDs.

Both protocols call a merchant-configured endpoint and may repeat a notification after failed delivery. They are payment notifications with no route into AI search or model training. Robots.txt does not apply, and a PayPal-looking user agent cannot replace cryptographic or protocol verification.

Not relevant for AI search

Is PayPal relevant for AI search?

No. PayPal is not part of AI search or training, so allowing or blocking it does not change your AI visibility.

PayPal is not a crawler. It delivers webhook notifications to endpoints you registered, so it never fetches public content for an AI product. Robots.txt does not apply, and allowing or blocking it has no effect on AI search or training.

How to handle PayPal

For REST webhooks, keep the subscribed HTTPS listener on port 443 reachable and store its Webhook ID with the application configuration. Preserve the raw request body. Verify each notification locally with the PayPal certificate and transmission headers, or use PayPal's verification API, before applying payment state changes. Return a 2xx status after accepting a valid event and deduplicate by event or resource identifiers.

For IPN, return the required acknowledgment and perform the _notify-validate postback with the original field order and encoding unchanged. Process the notification only after PayPal replies VERIFIED and the transaction details match the merchant's records.

If either integration is retired, remove the REST webhook subscription or IPN listener URL in PayPal and close the corresponding route. Do not allow or block these payment callbacks through robots.txt, and never trust the PayPal user-agent token by itself.

Examples

A `PAYMENT.CAPTURE.COMPLETED` REST event reaches a merchant listener, which verifies the transmission signature before marking an order paid.
A subscription cancellation performed outside the merchant's application arrives as a webhook and updates access after signature validation.
A legacy IPN listener posts the untouched form payload back to PayPal and waits for `VERIFIED` before fulfilling the purchase.
PayPal retries a REST webhook after a 500 response, and the merchant's event ID check prevents a second refund action.

Frequently asked questions about PayPal

Learn about AI visibility monitoring and how Promptwatch helps your brand succeed in AI search.

No. REST webhooks send JSON and use transmission signatures tied to a Webhook ID. IPN sends form data and uses an HTTPS validation postback that returns `VERIFIED` or `INVALID`.