Authorize a PayPal order
Authorizes a previously created PayPal order (identified by order_id in
the body) and returns its authorization_id. Cart-token authenticated.
Before authorizing, the server applies the payer details PayPal holds for the approved order — the buyer’s email and the shipping address they chose in PayPal’s own UI — and reprices. That ordering is deliberate: those writes move the cart total, and authorizing first would leave PayPal holding funds for a total the cart no longer agrees with.
Returns 400 when the order id is invalid, 404 when the cart is not
found, 409 when the cart’s total no longer matches expected_total,
410 when the cart has already been processed or holds an authorized enrollment, 422 for invalid
parameters or a zero-amount cart, and 502 when those payer details
could not be applied at all. Nothing is authorized on 409 or 502.
Path Parameters
Opaque cart token returned by the create-cart response. It scopes the request to a single cart and is the credential for these endpoints — cart-token authentication carried in the path, with no bearer token or API key.
Body
PayPal order id returned from order creation.
The cart total the client showed the shopper, as a decimal
string in the cart currency's major unit ("141.74"), taken
from amount_total of the cart the client last rendered.
Requires expected_currency.
Checked after the payer details are applied and before the
authorize request, which is the only point at which the
total can be judged: the address PayPal supplied has to be
priced first. When it no longer matches, the response is
409 with meta.code = cart_total_changed and nothing is
authorized.
A fallback rather than the primary source. The approved PayPal order carries its own amount, that is the total the shopper consented to, and where the two disagree PayPal's is the one the cart is held to. Omitting the pair therefore does not skip the check; it only gives up the fallback for an order whose amount cannot be read.
^\d{1,12}(\.\d{1,5})?$"141.74"
ISO 4217 code of the currency the shopper was shown, from currency_code of the same cart. Requires expected_total.
"USD"
Response
Order authorized
Success body for PayPal order authorization.
true when the PayPal order was authorized.
PayPal order id that was authorized.
PayPal authorization id for the authorized funds.
Standard response metadata included on every response.
The amount PayPal now holds for this order. Present whenever the authorize response carried a readable amount.
Clients re-pin the total they show the shopper to this before completing checkout, so that pin is the authorization itself rather than a later read of a cart anything could have repriced in between. That matters most where the shopper agreed to a total the client never rendered: an express wallet order repriced by a server-side shipping callback is approved inside the wallet, and the browser's own figure predates it.