Tag See all →

#paypal

2 stories

Incidents & Postmortems Bug Report

Customers credited twice: PayPal webhook retries hit a non-idempotent handler

Daniel Tran · Mar 31, 2025 · 9 min read

A slow accounting API pushed our PayPal webhook handler past the nginx timeout. PayPal saw a 504 and retried, while the first request was still running, and 41 wallets were topped up twice. Postmortem plus the idempotent design we moved to.

Banner: Content-Security-Policy header blocking a payment SDK script and iframe on a checkout page

Web Development Bug Report

PayPal checkout button blank in production: Content-Security-Policy blocked the SDK

Daniel Tran · Mar 4, 2025 · 10 min read

Our PayPal checkout button rendered in development and staging but was an empty box in production. A new Content-Security-Policy set in Nginx blocked the PayPal SDK script, its iframes and its API calls. We fixed it per directive, with a nonce and a report-only rollout.