FloPay Backend Changelog

v1.7.24 - More reliable PayPal checkout intents #

PayPal payment and vaulted setup intents now handle incompatible checkout destinations safely, reducing avoidable failures while preserving existing integrations.

PayPal payment and vaulted setup intents are now more resilient when a checkout session contains a successUrl or cancelUrl that PayPal cannot accept. Flo substitutes its standard checkout destination only for the incompatible value, while valid merchant destinations continue to be used.

What changed

• For direct PayPal payments and vaulted setup flows, relative, malformed, non-HTTP(S), or credential-bearing success and cancellation destinations are replaced before the intent is created.
• Success and cancellation destinations are handled independently, so a valid merchant URL remains in place when only the other value is incompatible.

Why it matters

• Existing checkout sessions with older relative or otherwise incompatible destinations are no longer rejected by PayPal solely because of those URL formats.
• Merchants retain their custom approval destinations whenever those values are valid for PayPal.

Developer notes

• For custom PayPal approval destinations, continue supplying absolute HTTP(S) URLs without embedded credentials in successUrl and cancelUrl.
• The request and response contract for POST /v1/checkouts/sessions/:id/intents, including its existing generic 500 response for provider failures, is unchanged.
• No SDK update, payload migration, configuration change, or merchant action is required. This release contains no breaking changes or removed public APIs.