OptionalcspA Content-Security-Policy nonce for the JS SDK <script> the adapter
injects, set as both its nonce and its data-csp-nonce attribute before
the tag is inserted. The browser checks nonce against script-src; the
SDK reads only data-csp-nonce and sets it on the inline scripts and
styles it creates, which PayPal's nonce-based policy needs. Unlike
nonce, which the browser hides from CSS selectors once the tag is
connected under a header-delivered policy, data-csp-nonce stays readable
to attribute selectors, so only this tag carries it. Pass the value alone,
as in the policy's 'nonce-<value>' source; the constructor refuses
anything else. The adapter never reads a nonce from the page, a
loadScript seam loads the script without it, and an SDK the page already
loaded is used as it is.
OptionalcurrencyThe JS SDK bakes the currency into its script URL and window.paypal is a page-wide singleton, so one page LOAD serves ONE currency (default "USD"). Another currency requires a full page navigation or reload — see the PayPal guide.
Explicit and validated, like every PayFanout adapter — even though the PayPal SDK infers sandbox vs live from the client id alone.
OptionalgetOptionalintentSDK intent — load-time and page-wide like currency, must match the
order's intent: "capture" (default) for automatic capture, "authorize"
for manual-capture sessions.
OptionalloadTest seam. Called again by the next loadSdk() after an attempt that rejects or leaves the SDK global missing, so it must be safe to call more than once.
OptionallocaleSDK display locale — a load-time query param (e.g. "fr-FR").
OptionalsdkTest seams.
OptionaluserClient half of the server's userAction, sent as the SDK's commit
query param so the popup's final button matches what happens next:
"continue" (default, commit=false) shows "Continue" — PayFanout's Pay
button completes the payment afterwards; "pay_now" (commit=true) belongs
to capture-on-approval flows. Both adapters must agree.
REST app client id — public, holds no secret authority.