# PayPal activation - no file editing

The application is complete. Live activation needs the private credentials from the owner's PayPal Business account and a public HTTPS domain. These values cannot be preloaded into a downloadable package.

## 1. PayPal application

In the PayPal Developer Dashboard:

1. Select **Apps & Credentials**.
2. Create or select a REST application.
3. Start with **Sandbox**.
4. Copy the Sandbox Client ID and Secret.
5. Add a webhook URL using the final domain:
   `https://YOUR-DOMAIN/api/paypal/webhook`
6. Subscribe to:
   - `PAYMENT.CAPTURE.COMPLETED`
   - `PAYMENT.CAPTURE.DENIED`
   - `PAYMENT.CAPTURE.REFUNDED`
   - `PAYMENT.CAPTURE.REVERSED`
7. Copy the Webhook ID.

## 2. Automated configuration

Run:

```bash
npm run configure
```

Enter the requested PayPal values and domain. The wizard writes the private `.env` file. Do not edit any source file.

## 3. Verify

Run:

```bash
npm run preflight
npm test
npm run smoke
```

Then deploy:

```bash
docker compose up -d --build
```

## 4. Switch to Live

After a successful Sandbox transaction, run `npm run configure` again and select **live**. Enter the Live Client ID, Secret and Live Webhook ID. Then rebuild:

```bash
docker compose up -d --build
```

## Payment and delivery controls implemented

- US$14.99 and USD are fixed and verified server-side.
- Product SKU is verified after capture.
- Digital-goods checkout uses `NO_SHIPPING`.
- PayPal captures must be `COMPLETED` before delivery.
- The PDF is stored outside the public web directory.
- A completed purchase creates one time-limited entitlement.
- The download token is stored only as a SHA-256 hash.
- The first download atomically invalidates the entitlement.
- A second download request returns `410 Gone` and requires another purchase.