<p>What's the output in your templates of:</p>

<pre><code>{{ craft.config.tokenParam }}
</code></pre>

<p>If it isn't <code>t</code> suspect your config is not setting the tokenParam for some reason.</p>

<p>Can you test with a stripped out general.php with only hard-coded values (No multi-environment config, or <code>if($_SERVER ...</code> checks) </p>

<pre><code>return array(
    'tokenParam' =&gt; 'myCraftToken'
    // ..other hard coded settings
);
</code></pre>

CC BY-SA 3.0
2017-11-30T19:33:10.600Z
Bingo.  Thank you Luke.  Using {{ craft.config.tokenParam }} we were able to narrow it down.  Server security issue on our end.  Commerce worked perfectly.  Awesome product.
user1663102
CC BY-SA 3.0
2017-11-30T01:35:56.823Z
2017-11-30T01:35:56.823Z
Luke Holder
<p>Things I can think of to check:</p>

<p>Are you using test mode, or is this live (and have you got that set correctly in Commerce's settings?).  If live, test mode needs to be <code>false</code>.</p>

<p>Also, do you have the appropriate action, redirect for complete payments and cancelled ones set in your form?</p>

<pre><code> &lt;input type="hidden" name="action" value="commerce/payments/pay"&gt;
 &lt;input type="hidden" name="redirect" value="/cart/complete?number={{ cart.number }}"&gt;
 &lt;input type="hidden" name="cancelUrl" value="/cart/payment"&gt;
</code></pre>

<p>Also, try disabling CSRF on your site for your testing - does that make a difference?</p>

<p>When do you get that url/error - is that when it's re-directing to Paypal, or when it is coming back?</p>

CC BY-SA 3.0
2017-11-28T14:03:08.033Z
Hello Jeremy,
I am not in test mode.  I checked that as well as the actions in the form.  It is giving me the error when it is coming back from PayPal.
user1663102
CC BY-SA 3.0
2017-11-28T19:08:25.413Z
Did you try disabling CSRF as a test?
Brad Bell
CC BY-SA 3.0
2017-11-28T22:35:17.090Z
Also where you say `https://www.site.com` - you've manually changed that here, right?  That's not the actual url you're getting back (in which case it would be your site url being wrong I guess?)
Jeremy Daalder
CC BY-SA 3.0
2017-11-28T22:48:08.610Z
Hey Jeremy.  I replaced my site name with that.
user1663102
CC BY-SA 3.0
2017-11-28T22:50:08.830Z
Hey Brad, yes I tried disabling CSRF.  I bought another license for Commerce today for another site.  It is doing the exact same thing.  It was straight out of the box.  So whatever I am doing (or not doing) I am being consistent.  With this second there is nothing I changed from the original code.
user1663102
CC BY-SA 3.0
2017-11-28T22:58:39.283Z
Can you post your form code, just for extra checking
Jeremy Daalder
CC BY-SA 3.0
2017-11-29T15:49:10.183Z
<form method="POST" class="form-horizontal" id="paymentForm">
     <input type="hidden" name="action" value="commerce/payments/pay"/>
     <input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/>
     <input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/>
     {{ getCsrfInput() }}
user1663102
CC BY-SA 3.0
2017-11-29T15:51:46.043Z
After reading the docs another 60 times it seems as though the tokenparam setting is not taking effect.  I added it to the craft config file.  Whatever I am missing it is doing it on two commerce sites I am trying to develop.  This is the first two commerce sites I have done.  Everything was simple until I got to this step.
user1663102
CC BY-SA 3.0
2017-11-29T18:39:21.400Z
Can you edit the original question to share your `craft/config/general.php` file where you're setting the `tokenParam` config setting?
Brad Bell
CC BY-SA 3.0
2017-11-28T02:46:49.450Z
2017-11-28T02:46:49.450Z
Jeremy Daalder
<p>I have entered API Username, Password and Signature from PayPal and added 'tokenParam' => 'craftToken' in Craft config and yet when I try to make a payment using PayPal Express I get the following....</p>

<p><a href="https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&amp;commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&amp;token=EC-9GX1527947961953D&amp;PayerID=RFN3LXKUP6SVQ" rel="nofollow noreferrer">https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&amp;commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&amp;token=EC-9GX1527947961953D&amp;PayerID=RFN3LXKUP6SVQ</a></p>

<p>With the following error:  The requested URL was not found on this server.</p>

<p>Any suggestions on what I have missed.</p>

<p>Here is my <code>craft/config/general.php</code> file.</p>

<pre><code>$domain = 'www.site.com';

if($_SERVER["HTTPS"] != "on")
{
    header("Location: https://" . $domain . $_SERVER["REQUEST_URI"]); exit(); 
}

define('URI_SCHEME',  ( isset($_SERVER['HTTPS'] ) ) ? "https://" : "http://" );
define('SITE_URL',    URI_SCHEME . $_SERVER['SERVER_NAME'] . '/');
define('BASEPATH',    realpath(CRAFT_BASE_PATH . '/../') . '/');

return array(
    '*' =&gt; array(
            'siteUrl' =&gt; SITE_URL,
            'environmentVariables' =&gt; array(
            'siteUrl'  =&gt; SITE_URL,
            'basePath' =&gt; BASEPATH,
            'defaultImageQuality' =&gt; 60,
            'omitScriptNameInUrls' =&gt; true,
            'tokenParam' =&gt; 't',
        ),
    ),
);
</code></pre>

<p>FORM</p>

<pre><code>{% if cart.paymentMethodId %}

    &lt;form method="POST" class="form-horizontal" id="paymentForm"&gt;

        &lt;input type="hidden" name="action" value="commerce/payments/pay"/&gt;
        &lt;input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/&gt;
        &lt;input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/&gt;

        {{ getCsrfInput() }}
</code></pre>

<plugin-craftcommerce>
PayPal Express not redirecting back to Craft Commerce
# PayPal Express not redirecting back to Craft Commerce

(Asked by: username_0 on 2017-11-27)

I have entered API Username, Password and Signature from PayPal and added 'tokenParam' => 'craftToken' in Craft config and yet when I try to make a payment using PayPal Express I get the following....
https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&token=EC-9GX1527947961953D&PayerID=RFN3LXKUP6SVQ
With the following error:  The requested URL was not found on this server.
Any suggestions on what I have missed.
Here is my craft/config/general.php file.
$domain = 'www.site.com';

if($_SERVER["HTTPS"] != "on")
{
    header("Location: https://" . $domain . $_SERVER["REQUEST_URI"]); exit(); 
}

define('URI_SCHEME',  ( isset($_SERVER['HTTPS'] ) ) ? "https://" : "http://" );
define('SITE_URL',    URI_SCHEME . $_SERVER['SERVER_NAME'] . '/');
define('BASEPATH',    realpath(CRAFT_BASE_PATH . '/../') . '/');

return array(
    '*' => array(
            'siteUrl' => SITE_URL,
            'environmentVariables' => array(
            'siteUrl'  => SITE_URL,
            'basePath' => BASEPATH,
            'defaultImageQuality' => 60,
            'omitScriptNameInUrls' => true,
            'tokenParam' => 't',
        ),
    ),
);

FORM
{% if cart.paymentMethodId %}

    

        
        
        

        {{ getCsrfInput() }}

**Tags:** plugin-craftcommerce

---

## 2 answers

### Answer by username_1 on 2017-11-30. Score: 3 | Accepted answer

What's the output in your templates of:
{{ craft.config.tokenParam }}

If it isn't t suspect your config is not setting the tokenParam for some reason.
Can you test with a stripped out general.php with only hard-coded values (No multi-environment config, or if($_SERVER ... checks) 
return array(
    'tokenParam' => 'myCraftToken'
    // ..other hard coded settings
);

> **Comments:**
> **username_0**: Bingo.  Thank you Luke.  Using {{ craft.config.tokenParam }} we were able to narrow it down.  Server security issue on our end.  Commerce worked perfectly.  Awesome product.  

---

### Answer by username_2 on 2017-11-28. Score: 1

Things I can think of to check:
Are you using test mode, or is this live (and have you got that set correctly in Commerce's settings?).  If live, test mode needs to be false.
Also, do you have the appropriate action, redirect for complete payments and cancelled ones set in your form?
 
 
 

Also, try disabling CSRF on your site for your testing - does that make a difference?
When do you get that url/error - is that when it's re-directing to Paypal, or when it is coming back?

> **Comments:**
> **username_0**: Hello Jeremy, I am not in test mode.  I checked that as well as the actions in the form.  It is giving me the error when it is coming back from PayPal.  
> **username_3**: Did you try disabling CSRF as a test?  
> **username_2**: Also where you say `https://www.site.com` - you've manually changed that here, right?  That's not the actual url you're getting back (in which case it would be your site url being wrong I guess?)  
> **username_0**: Hey Jeremy.  I replaced my site name with that.  
> **username_0**: Hey Brad, yes I tried disabling CSRF.  I bought another license for Commerce today for another site.  It is doing the exact same thing.  It was straight out of the box.  So whatever I am doing (or not doing) I am being consistent.  With this second there is nothing I changed from the original code.  
> **username_2**: Can you post your form code, just for extra checking  
> **username_0**: <form method="POST" class="form-horizontal" id="paymentForm">      <input type="hidden" name="action" value="commerce/payments/pay"/>      <input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/>      <input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/>      {{ getCsrfInput() }}  
> **username_0**: After reading the docs another 60 times it seems as though the tokenparam setting is not taking effect.  I added it to the craft config file.  Whatever I am missing it is doing it on two commerce sites I am trying to develop.  This is the first two commerce sites I have done.  Everything was simple until I got to this step.  
> **username_3**: Can you edit the original question to share your `craft/config/general.php` file where you're setting the `tokenParam` config setting?  

---

