PHP集成PayPal支付网关未获取到授权链接问题排查

核心问题说明 #

你的Create Order接口已经返回了授权链接（即响应links数组中rel为payer-action的href字段），但代码存在两个关键问题导致你没拿到这个链接：

1. create_order函数仅返回订单ID，丢弃了包含授权链接的完整响应
2. 后续冗余发起了GET订单查询请求，完全没必要

另外代码还有两个潜在风险点：

• create_order中的$my_request_id和$my_reference_id是未定义变量，会导致请求JSON出现无效占位符
• 开启了CURLOPT_SSL_VERIFYPEER=false，生产环境会引发安全问题

当前Create Order接口返回（已包含授权链接）：

{
    "id": "2H5...815N",
    "intent": "CAPTURE",
    "status": "PAYER_ACTION_REQUIRED",
    "payment_source": {
        "paypal": {}
    },
    "purchase_units": [{
        "reference_id": "d...b",
        "amount": {
            "currency_code": "EUR",
            "value": "10.00"
        },
        "payee": {
            "email_address": "sb-...@example.com",
            "merchant_id": "P...6",
            "display_data": {
                "brand_name": "EXAMPLE INC"
            }
        }
    }],
    "create_time": "2023-..-..T14:17:18Z",
    "links": [{
        "href": "https://api.sandbox.paypal.com/v2/checkout/orders/2H...5N",
        "rel": "self",
        "method": "GET"
    }, {
        "href": "https://www.sandbox.paypal.com/checkoutnow?token=2H...N",
        "rel": "payer-action",
        "method": "GET"
    }]
}

代码修复方案 #

1. 修改create_order函数，提取授权链接 #

将函数改为返回包含订单ID和授权链接的数组，同时修复未定义变量问题：

function create_order($access_token) {
    // 确保这两个变量已提前定义（建议设为唯一值，保证请求幂等性）
    global $my_request_id, $my_reference_id;
    
    $http_header = array(
        "Content-Type: application/json",
        "Authorization: Bearer $access_token",
        "PayPal-Request-Id: $my_request_id"
    );
    
    // 用数组转JSON避免字符串变量解析错误
    $post_data = array(
        "intent" => "CAPTURE",
        "purchase_units" => array(
            array(
                "reference_id" => $my_reference_id,
                "amount" => array(
                    "currency_code" => "EUR",
                    "value" => "10.00"
                )
            )
        ),
        "payment_source" => array(
            "paypal" => array(
                "experience_context" => array(
                    "payment_method_preference" => "IMMEDIATE_PAYMENT_REQUIRED",
                    "payment_method_selected" => "PAYPAL",
                    "brand_name" => "EXAMPLE INC",
                    "locale" => "en-US",
                    "landing_page" => "LOGIN",
                    "user_action" => "PAY_NOW",
                    "return_url" => "https://mydomain/accept_payment.php",
                    "cancel_url" => "https://mydomain/cancel_payment.php"
                )
            )
        )
    );
    
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "https://api-m.sandbox.paypal.com/v2/checkout/orders");
    curl_setopt($ch, CURLOPT_HEADER, false);
    // 移除SSL验证关闭设置，生产环境必须开启证书验证
    // curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, $http_header);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
    
    $result = curl_exec($ch);
    $arr_result = json_decode($result);
    curl_close($ch);
    
    // 从响应中提取授权链接
    $approve_link = '';
    if (!empty($arr_result->links)) {
        foreach ($arr_result->links as $link) {
            if ($link->rel === 'payer-action') {
                $approve_link = $link->href;
                break;
            }
        }
    }
    
    return array(
        'order_id' => $arr_result->id,
        'approve_link' => $approve_link
    );
}

2. 简化主逻辑，移除冗余请求 #

直接从create_order的返回结果中获取授权链接，无需额外查询：

$access_token = getAccessToken();
$order_data = create_order($access_token);
echo "订单ID: " . $order_data['order_id'] . "\n";
echo "授权链接: " . $order_data['approve_link'] . "\n";

// 可直接跳转至授权链接，或返回给前端处理
// header("Location: " . $order_data['approve_link']);

额外注意事项 #

• $my_request_id需设为唯一值，用于防止重复创建订单，保证请求幂等性
• 生产环境绝对不能关闭SSL证书验证，否则会导致请求被劫持的安全风险
• 建议增加接口错误判断，比如检查HTTP状态码是否为201（Create Order成功的标准状态码），避免请求失败时执行后续逻辑

内容的提问来源于stack exchange，提问作者SIVAKOSARAN