How to create a read-only PayPal REST app

Updated 2026-08-04

Creating one

  1. Sign in to the PayPal developer dashboard with your PayPal Business account.
  2. Go to Apps & Credentials.
  3. Switch to Live — not Sandbox, unless you're testing.
  4. Click Create App, name it, and choose Merchant.
  5. Copy the Client ID and Secret.

Scoping it down

On the app's detail page you can enable and disable individual features. For a reporting integration:

Enable: - Transaction Search / reporting access

Disable everything else, in particular: - Payouts - Refunds - Subscriptions management - Invoicing - Vault

The principle is the same as Stripe restricted keys: grant only what a number depends on. PayPal's controls are coarser than Stripe's, but meaningfully better than Gumroad's or Lemon Squeezy's account-scoped tokens.

What FRGMNT reads with it

PayPal does not contribute to True MRR. PayPal supports recurring billing, but FRGMNT does not currently compute recurring revenue from it. If a meaningful share of your subscriptions bill through PayPal, your MRR will understate reality. See the PayPal integration.

Both values are stored in your device Keychain and used to call PayPal's API directly from your phone.

Sandbox first

PayPal makes it easy to test: create a Sandbox app instead of a Live one and connect that first. No real money is involved, so you can verify a tool behaves before pointing it at your actual account.

Revoking

Delete the app from Apps & Credentials, or regenerate its secret. Either invalidates the credentials immediately.

Frequently asked

How do I get PayPal API credentials?

Sign in to the PayPal developer dashboard, go to Apps and Credentials, create a REST API app under Live, and copy the client ID and secret.

Can PayPal REST credentials be scoped read-only?

Partly. You can enable and disable specific features on the app, so you can grant transaction search and reporting while denying payouts and refunds.

Do I need a PayPal Business account?

In practice yes — creating a live REST app requires an account that can access the developer dashboard.

Read next