What should I consider when going from the Sandbox to Live PayPal with hosted buttons?
In PayPal Payments Standard, you can create and store buttons on the PayPal site. These hosted buttons have a hidden variable, hosted_button_id, which has a numerical value. This ID number points to a particular button created by a merchant or developer; it's also unique to a particular PayPal account.
The following example shows code for an unencrypted button. The business variable line (in red) shows how the PayPal system determines which PayPal account to credit the payment to. If you use this example, ensure that your Business email address is that of your Live PayPal account email, not your Sandbox account email.
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_blank">
<input type="hidden" name="cmd" value="_cart">
<input type="hidden" name="business" value="seller@business.com">
<input type="hidden" name="item_name" value="testing_handling">
<input type="hidden" name="item_number" value="test">
<input type="hidden" name="amount" value="0.01">
<input type="hidden" name="handling" value="0.01">
<input type="hidden" name="shipping" value="0.01">
<input type="hidden" name="lc" value="US">
<input type="hidden" name="bn" value="PP-BuyNowBF">
<input type="image" src="btn_buynow_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
<img alt=" border="0" src="pixel.gif" width="1" height="1">
<input type="hidden" name="add" value="1">
</form>
The next example is the code for a hosted button, with the hosted_button_id line in red.
<form target="paypal" action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="353581">
<input type="image" src="https://www.paypal.com/en_US/i/btn/btn_cart_LG.gif" border="0" name="submit" alt=">
<img alt=" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>
In the past, once a developer had built buttons in the Sandbox environment and wanted to take them to the Live website and environment, they only had to change the value of the action in the HTML form from https://www.sandbox.paypal.com/cgi-bin/webscr to https://www.paypal.com/cgi-bin/webscr. If they used a different email address in the Sandbox, they would also have to update this value when they were ready to go live.
However, a hosted button created in the Sandbox doesn't necessarily have the same value for hosted_button_id as a button created on the Live PayPal site. Once you're ready to go live with your integration, you need to create new hosted buttons on the Live PayPal site.
If you don't do this, live payments could be credited to another PayPal account, or, if the hosted_button_id value isn't found on in the Live site database, the buyer may get an error when they click the button.