Ghost + PayPal: Recurring Memberships Without Stripe

SETUPGhost + PayPal: RecurringMemberships Without Stripe
On this page

Most people arrive at PayPal for one reason: it pays out in places the merchant-of-record providers do not. If Stripe does not operate where you live and Paddle cannot send you money either, PayPal is often what is left.

It is also the most different provider in this set, and the differences are worth understanding before you spend an evening on it.

Three things that are not like the others

It is a processor, not a catalogue. PayPal does not hold a product list you can browse from outside. You create subscription plans inside your PayPal Business account, and PayGlue listens for the events those plans produce.

Subscriptions only. The supported path here is PayPal subscription plans. One-off PayPal Checkout payments are not part of this setup.

It is not a merchant of record. PayPal moves money. The VAT obligation stays with you. That is the trade you make for the country coverage, and it is a real one. What merchant of record means, and when it is worth paying for.

What you need

  • A PayPal Business account. Not a personal one. Personal accounts cannot access live API credentials or create merchant subscription plans.
  • Live API credentials. Sandbox credentials do not work here.
  • At least one active subscription plan.
  • A Ghost site you administer.

If the developer portal shows you a banner about viewing sandbox credentials and upgrading to PayPal for Business, that is the account type problem talking. Sort it before going further, because nothing downstream will work until it is fixed.

Connect Ghost first

In Ghost: Settings, then Integrations, then Add custom integration. Name it PayGlue, copy the Admin API key and your site URL.

Create a subscription plan in PayPal

Plans live in your PayPal Business dashboard, not in the developer portal. This trips people up constantly, because everything else in this guide happens in the developer portal.

  1. Log in at paypal.com with the business account
  2. In the sidebar, click Get Paid (it may say “Accept Payments”)
  3. Click Subscriptions, then open Subscription Plans
  4. Click + Create plan
  5. Fill in name, billing cycle and price
  6. Activate it. A plan must be ACTIVE before PayGlue can see it

Each plan gets a Plan ID starting with P-. Keep it, you need it for the checkout link.

Create a REST API app

Now to the developer portal at developer.paypal.com.

Open Apps & Credentials and make sure you are in Live mode, not Sandbox. The toggle is at the top left, and getting this wrong is the single most common way to end up with credentials that fail the health check.

Click Create App, name it, and choose Merchant as the type. Copy the Client ID and Client Secret.

Add the webhook

Open your new app, scroll to Webhooks, click Add Webhook, and paste the webhook URL from your PayPal connection page. It ends in ?tenant=your-slug.

Enable these six events:

Event Fires when
BILLING.SUBSCRIPTION.ACTIVATED A subscription starts
BILLING.SUBSCRIPTION.CANCELLED A subscription is cancelled
BILLING.SUBSCRIPTION.EXPIRED A subscription expires
BILLING.SUBSCRIPTION.SUSPENDED A subscription is paused
BILLING.SUBSCRIPTION.UPDATED A subscription changes
PAYMENT.CAPTURE.COMPLETED A one-time payment completes

Save, and PayPal shows a Webhook ID. Copy it. PayPal uses it to verify that incoming webhooks are genuine, which is why it is a required field rather than an optional one.

Enter the three credentials

In PayGlue, open the PayPal connection page and fill in Client ID, Client Secret and Webhook ID. Save, then run the health check.

Three fields rather than the usual two, and all three have to be from the same live app. Mixing a sandbox client ID with a live secret produces an error that reads like a network problem.

What each event does to the membership

PayPal event What happens in Ghost
BILLING.SUBSCRIPTION.ACTIVATED Tier granted
BILLING.SUBSCRIPTION.UPDATED Tier stays active
BILLING.SUBSCRIPTION.CANCELLED Tier revoked
BILLING.SUBSCRIPTION.SUSPENDED Tier revoked
BILLING.SUBSCRIPTION.EXPIRED Tier revoked
PAYMENT.CAPTURE.COMPLETED Tier granted, one-time

After the credentials are saved, PayGlue loads your active plans and they appear in the Buy Button, Paywall and Pricing Table editors.

The checkout link is manual here. PayPal subscription plans use a direct URL:

https://www.paypal.com/webapps/billing/plans/subscribe?plan_id=P-XXXX

Replace P-XXXX with the Plan ID from your business account. Select the plan in the editor, then paste the URL into the URL field yourself.

Then choose the Ghost newsletter the member should get and the welcome email, and save.

What the buyer sees, and why it costs you something

A buyer clicking that link lands on a PayPal login page. They need a PayPal account to subscribe. That is PayPal’s requirement, not a setting.

This costs conversion. Somebody who would happily type a card number may not want to create an account, and you will lose a fraction of them at that screen.

It is worth saying plainly because the trade is the whole point of choosing PayPal: you accept a worse checkout in exchange for reaching people that no other provider on this list can pay you for. In a country where Stripe does not operate and Paddle cannot send you money, a checkout with friction beats no checkout at all.

If that trade does not apply to you, one of the merchant-of-record providers will convert better. The full comparison is here.

Test it, carefully

Since sandbox credentials do not work, your first real test is a real payment.

Create a plan at a token amount, subscribe to it yourself from a different PayPal account, watch the member appear in Ghost with the right tier, then cancel and confirm the access goes away. Then refund yourself.

Testing the cancellation matters more than testing the purchase. The grant is the part that gets noticed immediately when it breaks. The revoke is the part that fails silently for months.

Check Analytics, then Webhook Events if something does not land. No event at all is a delivery problem, a failed event is verification, and a processed event that changed nothing means the plan has no mapping.

The Stripe requirement still applies

Ghost will not show you its membership settings until a Stripe account is connected, even though Stripe will never see a cent of this.

If a Stripe account is available to you, connect it, leave it idle, and let PayPal do the work. It is a Ghost interface requirement, not a payment one.

If it is not available, which is often the reason people reach for PayPal in the first place, there is a second path with no Stripe account involved: access is carried by a label on the member and checked by the paywall script instead of by Ghost. Both cases are explained here.

Frequently asked

Do I need a PayPal Business account?

Yes, and there is no way around it. Personal accounts cannot see live API credentials or create subscription plans for merchant use. If the developer portal shows a banner about sandbox credentials and upgrading, that is what it is telling you.

Can I sell one-off purchases through PayPal?

Not through the plan mechanism this guide describes, which is subscriptions only. PayGlue does listen for PAYMENT.CAPTURE.COMPLETED, but the supported path here is subscription plans. For one-off sales, Gumroad or Ko-fi are a better fit.

Why do buyers have to log in to PayPal?

Because PayPal requires an account to manage a subscription. That is PayPal's rule, not a configuration you can change. It costs you some conversion, and it buys you reach into countries other providers cannot pay out to.

Do sandbox credentials work?

No. PayGlue needs live API credentials. That is a real difference from Paddle and Lemon Squeezy, and it means your first end-to-end test is a real payment to yourself that you then refund.

Am I responsible for VAT?

Yes. PayPal is a payment processor, not a merchant of record. It moves the money and leaves the tax obligation with you. If you would rather not deal with that, look at Paddle, Polar or Lemon Squeezy instead.