Answers.Body: <p>What's the output in your templates of:</p>
  
  <pre><code>{{ craft.config.tokenParam }}
  </code></pre>
  
  <p>If it isn't <code>t</code> suspect your config is not setting the tokenParam for some reason.</p>
  
  <p>Can you test with a stripped out general.php with only hard-coded values (No multi-environment config, or <code>if($_SERVER ...</code> checks) </p>
  
  <pre><code>return array(
      'tokenParam' =&gt; 'myCraftToken'
      // ..other hard coded settings
  );
  </code></pre>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-30T19:33:10.600Z
Answers.Text: Bingo.  Thank you Luke.  Using {{ craft.config.tokenParam }} we were able to narrow it down.  Server security issue on our end.  Commerce worked perfectly.  Awesome product.
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-30T01:35:56.823Z
Answers.LastActivityDate: 2017-11-30T01:35:56.823Z
Answers.UserDisplayName: Luke Holder
Answers.Body: <p>Things I can think of to check:</p>
  
  <p>Are you using test mode, or is this live (and have you got that set correctly in Commerce's settings?).  If live, test mode needs to be <code>false</code>.</p>
  
  <p>Also, do you have the appropriate action, redirect for complete payments and cancelled ones set in your form?</p>
  
  <pre><code> &lt;input type="hidden" name="action" value="commerce/payments/pay"&gt;
   &lt;input type="hidden" name="redirect" value="/cart/complete?number={{ cart.number }}"&gt;
   &lt;input type="hidden" name="cancelUrl" value="/cart/payment"&gt;
  </code></pre>
  
  <p>Also, try disabling CSRF on your site for your testing - does that make a difference?</p>
  
  <p>When do you get that url/error - is that when it's re-directing to Paypal, or when it is coming back?</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T14:03:08.033Z
Answers.Text: Hello Jeremy,
  I am not in test mode.  I checked that as well as the actions in the form.  It is giving me the error when it is coming back from PayPal.
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T19:08:25.413Z
Answers.Text: Did you try disabling CSRF as a test?
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T22:35:17.090Z
Answers.Text: Also where you say `https://www.site.com` - you've manually changed that here, right?  That's not the actual url you're getting back (in which case it would be your site url being wrong I guess?)
Answers.UserDisplayName: Jeremy Daalder
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T22:48:08.610Z
Answers.Text: Hey Jeremy.  I replaced my site name with that.
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T22:50:08.830Z
Answers.Text: Hey Brad, yes I tried disabling CSRF.  I bought another license for Commerce today for another site.  It is doing the exact same thing.  It was straight out of the box.  So whatever I am doing (or not doing) I am being consistent.  With this second there is nothing I changed from the original code.
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T22:58:39.283Z
Answers.Text: Can you post your form code, just for extra checking
Answers.UserDisplayName: Jeremy Daalder
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-29T15:49:10.183Z
Answers.Text: <form method="POST" class="form-horizontal" id="paymentForm">
       <input type="hidden" name="action" value="commerce/payments/pay"/>
       <input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/>
       <input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/>
       {{ getCsrfInput() }}
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-29T15:51:46.043Z
Answers.Text: After reading the docs another 60 times it seems as though the tokenparam setting is not taking effect.  I added it to the craft config file.  Whatever I am missing it is doing it on two commerce sites I am trying to develop.  This is the first two commerce sites I have done.  Everything was simple until I got to this step.
Answers.UserDisplayName: user1663102
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-29T18:39:21.400Z
Answers.Text: Can you edit the original question to share your `craft/config/general.php` file where you're setting the `tokenParam` config setting?
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-11-28T02:46:49.450Z
Answers.LastActivityDate: 2017-11-28T02:46:49.450Z
Answers.UserDisplayName: Jeremy Daalder
Body: <p>I have entered API Username, Password and Signature from PayPal and added 'tokenParam' => 'craftToken' in Craft config and yet when I try to make a payment using PayPal Express I get the following....</p>
  
  <p><a href="https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&amp;commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&amp;token=EC-9GX1527947961953D&amp;PayerID=RFN3LXKUP6SVQ" rel="nofollow noreferrer">https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&amp;commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&amp;token=EC-9GX1527947961953D&amp;PayerID=RFN3LXKUP6SVQ</a></p>
  
  <p>With the following error:  The requested URL was not found on this server.</p>
  
  <p>Any suggestions on what I have missed.</p>
  
  <p>Here is my <code>craft/config/general.php</code> file.</p>
  
  <pre><code>$domain = 'www.site.com';
  
  if($_SERVER["HTTPS"] != "on")
  {
      header("Location: https://" . $domain . $_SERVER["REQUEST_URI"]); exit(); 
  }
  
  define('URI_SCHEME',  ( isset($_SERVER['HTTPS'] ) ) ? "https://" : "http://" );
  define('SITE_URL',    URI_SCHEME . $_SERVER['SERVER_NAME'] . '/');
  define('BASEPATH',    realpath(CRAFT_BASE_PATH . '/../') . '/');
  
  return array(
      '*' =&gt; array(
              'siteUrl' =&gt; SITE_URL,
              'environmentVariables' =&gt; array(
              'siteUrl'  =&gt; SITE_URL,
              'basePath' =&gt; BASEPATH,
              'defaultImageQuality' =&gt; 60,
              'omitScriptNameInUrls' =&gt; true,
              'tokenParam' =&gt; 't',
          ),
      ),
  );
  </code></pre>
  
  <p>FORM</p>
  
  <pre><code>{% if cart.paymentMethodId %}
  
      &lt;form method="POST" class="form-horizontal" id="paymentForm"&gt;
  
          &lt;input type="hidden" name="action" value="commerce/payments/pay"/&gt;
          &lt;input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/&gt;
          &lt;input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/&gt;
  
          {{ getCsrfInput() }}
  </code></pre>
  
Tags: <plugin-craftcommerce>
Title: PayPal Express not redirecting back to Craft Commerce
ThreadText: # PayPal Express not redirecting back to Craft Commerce
  
  (Asked by: username_0 on 2017-11-27)
  
  I have entered API Username, Password and Signature from PayPal and added 'tokenParam' => 'craftToken' in Craft config and yet when I try to make a payment using PayPal Express I get the following....
  
  <https://www.site.com/index.php/actions/commerce/payments/completePayment?commerceTransactionId=114&commerceTransactionHash=0ec5451ed35b360311214dfa75aee88f&token=EC-9GX1527947961953D&PayerID=RFN3LXKUP6SVQ>
  
  With the following error: The requested URL was not found on this server.
  
  Any suggestions on what I have missed.
  
  Here is my `craft/config/general.php` file.
  
  ```
  $domain = 'www.site.com';
  
  if($_SERVER["HTTPS"] != "on")
  {
      header("Location: https://" . $domain . $_SERVER["REQUEST_URI"]); exit(); 
  }
  
  define('URI_SCHEME',  ( isset($_SERVER['HTTPS'] ) ) ? "https://" : "http://" );
  define('SITE_URL',    URI_SCHEME . $_SERVER['SERVER_NAME'] . '/');
  define('BASEPATH',    realpath(CRAFT_BASE_PATH . '/../') . '/');
  
  return array(
      '*' => array(
              'siteUrl' => SITE_URL,
              'environmentVariables' => array(
              'siteUrl'  => SITE_URL,
              'basePath' => BASEPATH,
              'defaultImageQuality' => 60,
              'omitScriptNameInUrls' => true,
              'tokenParam' => 't',
          ),
      ),
  );
  
  ```
  
  FORM
  
  ```
  {% if cart.paymentMethodId %}
  
      <form method="POST" class="form-horizontal" id="paymentForm">
  
          <input type="hidden" name="action" value="commerce/payments/pay"/>
          <input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/>
          <input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/>
  
          {{ getCsrfInput() }}
  
  ```
  
  **Tags:** plugin-craftcommerce
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2017-11-30. Score: 3 | Accepted answer
  
  What's the output in your templates of:
  
  ```
  {{ craft.config.tokenParam }}
  
  ```
  
  If it isn't `t` suspect your config is not setting the tokenParam for some reason.
  
  Can you test with a stripped out general.php with only hard-coded values (No multi-environment config, or `if($_SERVER ...` checks)
  
  ```
  return array(
      'tokenParam' => 'myCraftToken'
      // ..other hard coded settings
  );
  
  ```
  
  > **Comments:**
  > **username_0**: Bingo.  Thank you username_1.  Using {{ craft.config.tokenParam }} we were able to narrow it down.  Server security issue on our end.  Commerce worked perfectly.  Awesome product.  
  
  ---
  
  ### Answer by username_2 on 2017-11-28. Score: 1
  
  Things I can think of to check:
  
  Are you using test mode, or is this live (and have you got that set correctly in Commerce's settings?). If live, test mode needs to be `false`.
  
  Also, do you have the appropriate action, redirect for complete payments and cancelled ones set in your form?
  
  ```
   <input type="hidden" name="action" value="commerce/payments/pay">
   <input type="hidden" name="redirect" value="/cart/complete?number={{ cart.number }}">
   <input type="hidden" name="cancelUrl" value="/cart/payment">
  
  ```
  
  Also, try disabling CSRF on your site for your testing - does that make a difference?
  
  When do you get that url/error - is that when it's re-directing to Paypal, or when it is coming back?
  
  > **Comments:**
  > **username_0**: Hello username_2, I am not in test mode.  I checked that as well as the actions in the form.  It is giving me the error when it is coming back from PayPal.  
  > **username_3**: Did you try disabling CSRF as a test?  
  > **username_2**: Also where you say `https://www.site.com` - you've manually changed that here, right?  That's not the actual url you're getting back (in which case it would be your site url being wrong I guess?)  
  > **username_0**: Hey username_2.  I replaced my site name with that.  
  > **username_0**: Hey username_3, yes I tried disabling CSRF.  I bought another license for Commerce today for another site.  It is doing the exact same thing.  It was straight out of the box.  So whatever I am doing (or not doing) I am being consistent.  With this second there is nothing I changed from the original code.  
  > **username_2**: Can you post your form code, just for extra checking  
  > **username_0**: <form method="POST" class="form-horizontal" id="paymentForm">      <input type="hidden" name="action" value="commerce/payments/pay"/>      <input type="hidden" name="redirect" value="/shop/customer/order?number={number}"/>      <input type="hidden" name="cancelUrl" value="/shop/checkout/payment"/>      {{ getCsrfInput() }}  
  > **username_0**: After reading the docs another 60 times it seems as though the tokenparam setting is not taking effect.  I added it to the craft config file.  Whatever I am missing it is doing it on two commerce sites I am trying to develop.  This is the first two commerce sites I have done.  Everything was simple until I got to this step.  
  > **username_3**: Can you edit the original question to share your `craft/config/general.php` file where you're setting the `tokenParam` config setting?  
  
  ---
  
  