title: PayPal PayFlow Pro with Transparent Redirect - User Authentication Failed Issues / Documentation
body: <p>I'm having some difficulty integrating - and finding current documentation for - integrating <strong>PayPal PayFlow Pro</strong> into my website.</p>
  
  <p>There is a similar question here for PayFlow Link - <a href="https://stackoverflow.com/questions/15808604/result-1-respmsg-userauthenticationfailed-in-test-transaction-for-mastercard">https://stackoverflow.com/questions/15808604/result-1-respmsg-userauthenticationfailed-in-test-transaction-for-mastercard</a> - but I wanted to go into the specifics.</p>
  
  <p>I want to use the <strong>Transparent Redirect</strong> feature with the <strong>SILENTTRAN</strong> option so that:</p>
  
  <ol>
  <li>the credit card data is sent directly to the gateway (i.e. not through my server)</li>
  <li>the user is redirected back to a nominated page to confirm the transaction or error (reponse page).</li>
  </ol>
  
  <p>I'm currently reading through this document:
  <a href="https://www.paypalobjects.com/webstatic/en_US/developer/docs/pdf/payflowgateway_guide.pdf" rel="nofollow noreferrer">https://www.paypalobjects.com/webstatic/en_US/developer/docs/pdf/payflowgateway_guide.pdf</a></p>
  
  <p>This is listed as <em>Payflow Gateway Developer's Guide(PDF)</em> on this page - <a href="https://developer.paypal.com/webapps/developer/docs/classic/products/payflow-gateway/" rel="nofollow noreferrer">https://developer.paypal.com/webapps/developer/docs/classic/products/payflow-gateway/</a> - so I'm assuming it is the current documentation.</p>
  
  <p>According to page 28, the process should be:</p>
  
  <ol>
  <li>The customer clicks Buy to purchase merchandise on your website. [DONE]</li>
  <li>You request a secure token by passing a secure token ID to the Gateway server. In the  request, you pass the name-value pair, SILENTTRAN=TRUE. This name-value pair  prevents the hosted pages from displaying. [DONE]</li>
  <li>The Gateway server returns the secure token and your token ID to your website. [DONE]</li>
  <li>You display the credit card fields to the customer in a checkout page on your website. [DONE]</li>
  <li>The customer enters their credit card number, expiration date, and other sensitive  data into the credit card fields and clicks Submit. [DONE] The browser posts the payment data  directly to the Gateway server, avoiding your website and easing your PCI  compliance requirements. [PROBLEMS HERE]</li>
  </ol>
  
  <p>Below is an example of a secure token request for the transparent redirect. I've used placeholder in place of my actual live PayFlow Pro account details (this account states 'Payflow SDK/API (Full Access) Live' in the manager.paypal.com Service Summary), but I used my real PayPal credentials in the actual request. Likewise I used publicly accessible pages for my return URLs:</p>
  
  <pre><code>USER=MYUSER&amp;VENDOR=MYUSER&amp;PARTNER=VSA&amp;PWD=MYPASSWORD&amp;BILLTOFIRSTNAME=John&amp;BILLTOLASTNAME=Doe&amp;BILLTOSTREET=123 Fake Street&amp;BILLTOSTREET2=&amp;BILLTOCITY=Sydney&amp;BILLTOZIP=2000&amp;BILLTOPHONENUM=5555555555&amp;EMAIL=me@email.com&amp;BILLTOSTATE=NSW&amp;AMT=0.05&amp;RETURNURL=http://www.example.com&amp;CANCELURL=http://www.example.com&amp;ERRORURL=http://www.example.com&amp;TRXTYPE=A&amp;SILENTTRAN=TRUE&amp;VERBOSITY=HIGH&amp;CREATESECURETOKEN=Y&amp;TENDER=C&amp;SECURETOKENID=VDUOBDNLSXTLYAAAAAATLSEBLAAAAAAAAAA
  </code></pre>
  
  <p>I perform the token transaction using server-side code, and I can see that I'm getting a response back like so:</p>
  
  <pre><code>RESULT=0&amp;SECURETOKEN=TOKENWASHEREsdsdfjkj&amp;SECURETOKENID=VDUOBDNLSXTLYAAAAAATLSEBLAAAAAAAAAA&amp;RESPMSG=Approved
  </code></pre>
  
  <p>So it seems like the account authenticates correctly here. I have confirmed in Fiddler that I am posting this request to <a href="https://payflowpro.paypal.com" rel="nofollow noreferrer">https://payflowpro.paypal.com</a>.</p>
  
  <p>I then take that response and put this into a HTML form which posts back to the gateway, e.g.:</p>
  
  <p>
      
      
            </p>
  
  <pre><code>    &lt;form id="form" action="https://payflowpro.paypal.com" method="post"&gt;
  
          &lt;!-- &lt;input name="MODE" class="inpPPField" id="hdn_pp_mode" type="hidden" value="Test"&gt; --&gt;
  
          &lt;input name="SECURETOKEN" class="inpPPField" id="hdn_pp_securetoken" type="hidden" value="TOKENWASHEREsdsdfjkj"&gt;
  
          &lt;input name="SECURETOKENID" class="inpPPField" id="hdn_pp_securetokenid" type="hidden" value="VDUOBDNLSXTLYAAAAAATLSEBLAAAAAAAAAA"&gt;
  
          &lt;input name="CARDNUM" class="inpPPField" id="hdn_pp_CardNum" type="hidden" value="4111111111111111"&gt;
  
          &lt;input name="EXPMONTH" class="inpPPField" id="hdn_pp_expMonth" type="hidden" value="11"&gt;
  
          &lt;input name="EXPYEAR" class="inpPPField" id="hdn_pp_expYear" type="hidden" value="16"&gt;
  
          &lt;input name="CVV2" class="inpPPField" id="hdn_pp_cvv2" type="hidden" value="123"&gt;
  
          &lt;!--&lt;input name="SILENTTRANS" class="inpPPField" id="hdn_pp_silenttrans" type="hidden" value="Y"&gt;--&gt;
  
          &lt;input name="VERBOSITY" class="inpPPField" id="hdn_pp_verbosity" type="hidden" value="HIGH"&gt;
  
          &lt;input class="inpPPField" type="submit" value="Submit" /&gt;
  
      &lt;/form&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p> </p>
  
  <p>Please note that I used the same token ID and token as what was returned in the token reponse - these are placeholders. I also used an actual credit card number and other credit-card field values.</p>
  
  <p>This is posting me to <a href="https://payflowpro.paypal.com" rel="nofollow noreferrer">https://payflowpro.paypal.com</a>, which just states the response (in the body of the page):</p>
  
  <blockquote>
    <p>RESULT=1&amp;RESPMSG=User authentication failed</p>
  </blockquote>
  
  <p>Shouldn't this be returning me to my error page? Or is it failing earlier in the process so that the gateway never even tries to interpret the token and redirect? I've tried setting my return URLs to live website URLs, and it doesn't seem to be making a difference. I've also tried posting this from a publicly accessible web-server rather than localhost, but the result is the same. </p>
  
  <p>One other problem I'm having is finding relevant documentation. There is a 'Payflow Service Testing' document here:
  <a href="https://ppmts.custhelp.com/app/answers/detail/a_id/456/kw/payflow%20pro%20transparent%20redirect%20error%20page%20get%20codes" rel="nofollow noreferrer">https://ppmts.custhelp.com/app/answers/detail/a_id/456/kw/payflow%20pro%20transparent%20redirect%20error%20page%20get%20codes</a></p>
  
  <p>This page is dated 2007, and the link under the <strong>Testing using Payflow Pro</strong> heading (i.e. The guide is available at x.com) is broken. The guide is a little vague, and the only examples of code I've found are in PHP (see <a href="https://go.developer.ebay.com/developers/community/blogs/pp_integrations_nate/payflow-transparent-redirect" rel="nofollow noreferrer">https://go.developer.ebay.com/developers/community/blogs/pp_integrations_nate/payflow-transparent-redirect</a>). I have rewritten the logic in the example as an ASP.Net application.</p>
  
  <p>In summary, my questions are:</p>
  
  <ol>
  <li>Am I using the correct logic to process a credit card transaction?</li>
  <li>If not, can someone point out where I am going wrong, and where I can find the most relevant and current documentation </li>
  <li>A link(s) for the most current test procedure documents </li>
  </ol>
  
  <p>My next idea is to try setting up an using a test account using these instructions:
  <a href="https://ppmts.custhelp.com/app/answers/detail/a_id/929/" rel="nofollow noreferrer">https://ppmts.custhelp.com/app/answers/detail/a_id/929/</a> 
  Obviously this is for hosted PayFlow pages, but I suspect the procedure should be similar as long as I specify the SILENTTRAN option. I tried unsuccessfully to get the test account working earlier in the week, but it seems like the next logical thing to try at this point.</p>
  
  <p>I have already opened a support ticket open with PayPal engineers and they are looking into this, but it would be great to know if anyone in the community has managed to resolve a similar issue.</p>
  
  <p>EDIT: according to a PayPal engineer I just spoke to the <em>SILENTTRANS</em> value is only required in the secure token request. I have commented this out in the transaction request form above, but this did not solve the issue. We also confirmed that it is possible to do a non-secure-token (i.e. non-transparent-redirect) request to <a href="https://pilot-payflowpro.paypal.com/" rel="nofollow noreferrer">https://pilot-payflowpro.paypal.com/</a> using my account details.</p>
  
  <p>EDIT 2: I have been instructed by PayPal to use https://<strong>payflowlink</strong>.paypal.com/ (not https://<strong>payflowpro</strong>.paypal.com) for the transaction post URL, but to continue using <a href="https://payflowpro.paypal.com" rel="nofollow noreferrer">https://payflowpro.paypal.com</a> for the token request. This does allow me to get through to my confirmation page using a transparent redirect (which is a great outcome), but it doesn't make a lot of sense to me that I'm using the 'payflowlink' rather than the 'payflowpro' gateway. I also found this tutorial which seems to support this <a href="https://go.developer.ebay.com/developers/community/blogs/ppintegrationsnate/new-payflow-gateway-tutorial" rel="nofollow noreferrer">https://go.developer.ebay.com/developers/community/blogs/ppintegrationsnate/new-payflow-gateway-tutorial</a> </p>
  
  <p><strong>Can anyone using the PayFlow Pro Transparent Product please confirm that this is correct (or otherwise).</strong></p>