router.php

<?php

require __DIR__ . '/vendor/autoload.php';

use Dotenv\Dotenv;
use PaypalServerSdkLib\Authentication\ClientCredentialsAuthCredentialsBuilder;
use PaypalServerSdkLib\Environment;
use PaypalServerSdkLib\Models\Builders\AmountWithBreakdownBuilder;
use PaypalServerSdkLib\Models\Builders\OrderRequestBuilder;
use PaypalServerSdkLib\Models\Builders\PurchaseUnitRequestBuilder;
use PaypalServerSdkLib\Models\CheckoutPaymentIntent;
use PaypalServerSdkLib\PaypalServerSdkClientBuilder;

Dotenv::createImmutable(__DIR__)->safeLoad();

// Create a configuration object for PayPal settings, using environment variables for sensitive information.
$paypalSettings = [
    'clientId' => $_ENV['PAYPAL_CLIENT_ID'] ?? null,
    'clientSecret' => $_ENV['PAYPAL_CLIENT_SECRET'] ?? null,
    'env' => $_ENV['PAYPAL_ENV'] ?? 'sandbox',
];

// A simple in-memory catalogue of items that can be purchased.
// In a real application, you would look this up from a database.
// Prices are held server-side so they can't be tampered with from the browser.
$items = [
    'demo-product' => ['currencyCode' => 'USD', 'value' => '9.99'],
];

// Create a PayPal client, configured with client credentials and environment settings,
// then get an OrdersController to handle order creation and capture.
$client = PaypalServerSdkClientBuilder::init()
    ->clientCredentialsAuthCredentials(
        ClientCredentialsAuthCredentialsBuilder::init(
            $paypalSettings['clientId'],
            $paypalSettings['clientSecret'],
        ),
    )
    ->environment($paypalSettings['env'] === 'live' ? Environment::PRODUCTION : Environment::SANDBOX)
    ->build();

$ordersController = $client->getOrdersController();

$method = $_SERVER['REQUEST_METHOD'];
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);

// Hands the front-end the public clientId, env, and the correct sdkUrl.
// Loading the SDK URL from the server lets you switch between sandbox and live
// without touching client code.
if ($method === 'GET' && $path === '/api/config') {
    header('Content-Type: application/json');
    echo json_encode([
        'clientId' => $paypalSettings['clientId'],
        'env' => $paypalSettings['env'],
        'sdkUrl' => $paypalSettings['env'] === 'live'
            ? 'https://www.paypal.com/web-sdk/v6/core'
            : 'https://www.sandbox.paypal.com/web-sdk/v6/core',
    ]);
    exit;
}

// Looks up the item by itemId, asks PayPal to create an order, and returns the order id.
if ($method === 'POST' && $path === '/api/orders') {
    $body = json_decode(file_get_contents('php://input'), true) ?? [];
    $item = $items[$body['itemId'] ?? ''] ?? null;

    if (!$item) {
        http_response_code(400);
        header('Content-Type: application/json');
        echo json_encode(['error' => 'Invalid item ID']);
        exit;
    }

    try {
        $apiResponse = $ordersController->createOrder([
            'body' => OrderRequestBuilder::init(
                CheckoutPaymentIntent::CAPTURE,
                [
                    PurchaseUnitRequestBuilder::init(
                        AmountWithBreakdownBuilder::init($item['currencyCode'], $item['value'])->build(),
                    )->build(),
                ],
            )->build(),
        ]);

        header('Content-Type: application/json');
        echo json_encode(['orderId' => $apiResponse->getResult()->getId()]);
    } catch (\Throwable $e) {
        error_log($e->getMessage());
        http_response_code(500);
        header('Content-Type: application/json');
        echo json_encode(['error' => 'Failed to create order']);
    }
    exit;
}

// Captures a previously approved order. Approving an order doesn't move any
// money on its own — capturing it does.
if ($method === 'POST' && preg_match('#^/api/orders/([^/]+)/capture$#', $path, $matches)) {
    try {
        $apiResponse = $ordersController->captureOrder(['id' => $matches[1]]);
        header('Content-Type: application/json');
        echo json_encode($apiResponse->getResult());
    } catch (\Throwable $e) {
        error_log($e->getMessage());
        http_response_code(500);
        header('Content-Type: application/json');
        echo json_encode(['error' => 'Failed to capture order']);
    }
    exit;
}

// Anything else falls through to the built-in server's static file handling in public/.
return false;