PayPal IPN is deprecated — the IPN Webhooks migration drops payments in four silent ways

Short summary

PayPal is deprecating IPN and Website Payments Standard by January 2027, replacing them with REST Webhooks — but the migration changes payload format, field names, status values, and verification method simultaneously. Each change has a silent failure mode where your handler returns HTTP 200, PayPal stops retrying, and the payment is never recorded. The article walks through all four failure patterns with code examples and fixes, including the loss of payer_email and the shift from callback verification to RSA-SHA256 signature validation.

• •IPN→Webhooks changes content-type, payload shape, status casing, and verification method — not a simple rename
• •All four failure modes return HTTP 200, causing PayPal to stop retrying while orders go unfulfilled silently
• •payer_email is absent from webhook capture resources, requiring an additional API call to retrieve buyer identity

Generated with AI, which can make mistakes.