PayPal integration question

[Paula]

I'm ready to set up payment processor. For PayPal Pro (regular credit cards and express checkout) which of the following do I choose?

Grant API Permissions is used by some 3rd party shopping carts. Please confirm with your shopping cart provider what information to use.
Request API Credentials is used to generate an API Username, API Signature, and API Signature or Certificate for your custom integration or 3rd party shopping cart.

[Jim]

You do not need the 3rd party permissions. That would be if you want to allow someone other than the owner of the PayPal account to access to the information or if you are using someone elses PayPal account with your store.. With ShopSite the store owner/manager is the only one that needs access and that is usually the person that sets up the PayPal account.

You can use either of these options
Use API Certificate Authentication
Use API Digital Signature Authentication

I believe that PayPal is leaning more toward the Digital Signature Authentication method but either will work with ShopSite.

The Order PaymentAction option is to say when a credit card is billed. If you sell digital goods or need to actually capture the funds for the order at the time the order is placed, use the "Sale" option. The Authorization method places a hold on credit card funds at the time the order is placed but does not actually transfer the money at that time. This would be used if you may take a while (few days) to process the order and then you will bill the order so the funds get captured when the order is actually sent.

[Paula]

Thanks...So as far as security/PCI compliance goes, I basically need an SSL-certificate which I can get from my host? Aside from that, is there anything else I need to do?

And then, do I just need to enter it under Hosting Service settings?

[Paula]

Also, I don't want to store credit card information if I don't have to. Do I have the option of clicking "Do not store credit cards" under Credit Card Storage?

[Jim]

If you are just using PayPal then they will handle all the Credit card info so you won't ever get the credit card information.
If you are just using PayPal you should NOT select any of the credit card types in the "Credit Cards" section of the Commerce Setup > Payment setup screen. If you do, they will display on the shopping cart and could be used to make a payment which you would not be able to process. This is because the the "manual (off-line)" payment processor is still enabled on the Commerce Setup > Payment setup screen if any of the "Credit cards" check boxes is checked.

[Jim]

As for the SSL certificate that would be installed by your host. They will need to tell you the appropriate urls which you can then setup on the Preferences > Hosting Services screen.

PCI certification can be a complicated process. ShopSite 11 itself has been certified ( see http://shopsite.com/pci-pa-dss.html ). You will also have to pass a PCI certification for your website. There are a number of things that you need to do. You should check the PCI Security Standards Council's website for more information. https://www.pcisecuritystandards.org/merchants/index.php

For your specific question about the Do not Store Credit Cards option. If you are only using PayPal for payment you will never see the credit card information so you don't need to check the "Do not store Credit Cards" on Orders > Security Credit card storage, but it won't hurt anything if you do.

[Paula]

Does this refer to PayPal Express or PayPal Pro or both?

If you are just using PayPal then they will handle all the Credit card info so you won't ever get the credit card information.
If you are just using PayPal you should NOT select any of the credit card types in the "Credit Cards" section of the Commerce Setup > Payment setup screen. If you do, they will display on the shopping cart and could be used to make a payment which you would not be able to process. This is because the the "manual (off-line)" payment processor is still enabled on the Commerce Setup > Payment setup screen if any of the "Credit cards" check boxes is checked.

[Jim]

That would apply only if you are using the normal PayPal or PayPal Express checkout.

If you are using PayPal Pro then the credit card number is in your data. So if you are using the PayPal Pro method youwould have to use the "Do not save the credit card" information option under Orders > Security > Credit Card storage inorder to be PCI complient.

[Paula]

I have the SSL certificate set up. Am under Hosting Service and would like to click SSL Security Settings. Do I click on Shopsite Secure or Shopsite Cart Secure?

Also, my shopping cart URL is super long with dozens of letters and numbers. Is this what I enter?

And it is normal for the https: not be appearing yet? The host said it does take time,

[Jim]

What is the the domain name in the secure certificate? Did your host tell you what you should configure in ShopSite?

The settings in ShopSite have to use what ever domain is in the certificate plus the paths to the cgis or images. Typically if the secure domain name is the same as your store domain name you would just copy the urls under the "Store" Settings area to the appropriate fields in the "SSL Security Settings" section and change the http to https. But if your secure url is not for the same domain as what your store pages are under the values will be entirely different.
This is how the fields match up.

Code: Select all

Store Settings                   SSL Security Settings
Store URL                 to       Secure Store URL             
Shopping Cart CGIs URL    to     Shopping Cart secure URL
Merchant CGIs URL         to      ShopSite secure URL
ShopSite Images URL       to      ShopSite Images secure URL

As your host said, it might take a little while for the https urls to be active because the DNS servers need time for the information to propogate through the Internet. Usually it takes a few hours but depending on your hosts server settings it might take a day or more.

You can test that you have the correct urls if you can enter either the secure url or the regular url in a browser and you get to the same screen, and everything looks the same on the screen. So before you make the changes in ShopSite just try that and see if what you think is the secure url goes to the same place as the non-secure url.

[Paula]

Jim

They did not give me any documents or emails. I asked and after running circles, finally got it figured out. I just added https://my domainname.com/sc and it seems to have worked; I got the S after http:// on the cart page and my dashboard says my security settings are high.

[Paula]

I ended up canceling my PayPal Pro account and am now JUST using PayPal Standard. On the Shopsite end, under Payment options, I clicked the PayPal Website Payments Standard button and configured, adding my PayPal email address. But when I go to checkout on my website, the yellow Pay with PayPal icon does not appear. Instead, I get the purple box that brings me to the PayPal checkout page when I click Submit Order. I'm assuming this is ok? And is there anything else I need on my end to shut PayPal Pro off?

Now that I'm not using PayPal Pro, under the Credit Card Processing box, can I just leave the setting at manual (off-line)?

And can I still use the Shopsite secure logo if just using PayPal Standard?

Thanks,

[Paula]

I placed a test order and received the following email, as well as the warning on my dashboard. I'm a little confused since I thought you don't need SSL if you use PayPal Standard. I switched to Express and have the same message.

*** WARNING! Your shopping cart is not taking orders using a
secure connection (e.g. SSL or HTTPS://) To configure SSL in
ShopSite go to Preferences and click on Hosting Service. ***

[Jim]

You do not NEED to use SSL if you are using PayPal standard since you do not collect any payment information on your site. However, it would still be a good idea to use it just to give your customers a sense of security for your site. When the shopper goes to PayPal they should have a secure page to enter their payment information. That message will be displayed in a store no matter what payment method is being used just as a reminder that it is best to use SSL any time you are handling shopper information such as when viewing orders.

[Paula]

Did you see the prior question: Do I choose PayPal Express or PayPal Standards? Not sure of the difference.