Express中PayPal订阅路由间如何传递subscriptionId

我用Express开发Node.js应用，集成PayPal订阅功能时遇到问题：无法把/create-subscription路由中从PayPal响应拿到的subscriptionId传递给/execute-subscription路由。

目标是从/create-subscription的响应里获取subscriptionId：

const response = await axios.post("https://api-m.sandbox.paypal.com/v1/billing/subscriptions", subscriptionDetails, {
  headers: {
    Authorization: `Bearer ${access_token}`,
  },
});

然后在/execute-subscription路由里用它激活订阅：

const subscriptionId = response.data.id; 

直接在/execute-subscription里访问response.data.id会报undefined，因为response不在这个路由的作用域里。

解决思路 #

PayPal订阅的标准流程是：创建订阅后生成授权链接，用户完成授权后，PayPal会跳转回你设置的return_url并携带订阅token。我们不需要手动传递subscriptionId，而是通过这个token从PayPal API获取订阅信息，再完成激活。

修改后的代码片段 #

/create-subscription 路由 #

paypalRouter.post("/create-subscription", async (req,res) => {
  try {
    const subscriptionDetails = {
      plan_id: process.env.PAYPAL_SANDBOX_BUSSINESS_SUBSCRIPTION_PLAN_ID,
      application_context: {
        brand_name: "brand",
        return_url: "http://localhost:3001/paypal/execute-subscription",
        cancel_url: "http://localhost:3001/paypal/cancel-subscription",
      }
    };

    // 获取PayPal访问令牌
    const params = new URLSearchParams();
    params.append("grant_type", "client_credentials");
    const authResponse = await axios.post(
      "https://api-m.sandbox.paypal.com/v1/oauth2/token",
      params,
      {
        headers: {
          "Content-Type": "application/x-www-form-urlencoded",
        },
        auth: {
          username: process.env.PAYPAL_CLIENT_ID,
          password: process.env.PAYPAL_SECRET,
        },
      }
    );

    const access_token = authResponse.data.access_token;

    // 创建订阅
    const response = await axios.post(
      "https://api-m.sandbox.paypal.com/v1/billing/subscriptions",
      subscriptionDetails,
      {
        headers: {
          Authorization: `Bearer ${access_token}`,
        },
      }
    );

    // 提取PayPal授权链接，返回给前端让用户跳转完成订阅授权
    const approvalUrl = response.data.links.find(link => link.rel === 'approve').href;
    console.log("订阅ID:", response.data.id);
    return res.json({ approvalUrl, subscriptionId: response.data.id });
  } catch (error) {
    console.log(error);
    return res.status(500).json("出现错误");
  }
});

/execute-subscription 路由 #

paypalRouter.get("/execute-subscription", async (req, res) => {
  const { token } = req.query; // PayPal跳转时携带的订阅token

  if (!token) {
    return res.status(400).send("缺少订阅token");
  }

  try {
    // 获取PayPal访问令牌
    const params = new URLSearchParams();
    params.append("grant_type", "client_credentials");
    const authResponse = await axios.post("https://api-m.sandbox.paypal.com/v1/oauth2/token", params, {
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
      },
      auth: {
        username: process.env.PAYPAL_CLIENT_ID,
        password: process.env.PAYPAL_SECRET,
      },
    });

    const access_token = authResponse.data.access_token;

    // 通过token获取订阅信息，拿到subscriptionId
    const subscriptionResponse = await axios.get(`https://api-m.sandbox.paypal.com/v1/billing/subscriptions?token=${token}`, {
      headers: {
        Authorization: `Bearer ${access_token}`,
      },
    });

    const subscriptionId = subscriptionResponse.data.id;

    // 激活订阅
    const executeResponse = await axios.post(
      `https://api-m.sandbox.paypal.com/v1/billing/subscriptions/${subscriptionId}/activate`, 
      {}, 
      {
        headers: {
          Authorization: `Bearer ${access_token}`,
          'Content-Type': 'application/json'
        },
      }
    );

    console.log("订阅已确认:", executeResponse.data);
    res.send("订阅成功！");
  } catch (error) {
    console.error("激活订阅出错:", error.response ? error.response.data : error.message);
    res.status(500).send("激活订阅时发生错误。");
  }
});

关键说明 #

1. 授权流程：创建订阅后，前端需要跳转到返回的approvalUrl，引导用户在PayPal页面完成订阅授权
2. token传递：用户完成授权后，PayPal自动跳转至return_url并携带token参数，无需手动传递subscriptionId
3. 安全可靠性：通过PayPal官方token机制获取订阅ID，避免跨路由传递数据的安全风险

内容的提问来源于stack exchange，提问作者user23826131