On the website I'm building I'm including a paypal subscribe button. Most everything is working fine in the sandbox. The user is processed through paypal's system and my IPN listener receives the notifications. One major issue that I'm running into is how to reliably link these notifications with a user on my website. The way I have it set up is they have to register before being able to subscribe so I can guarantee there will be a user linked with each notification.
I could use the payer_email. But what if they use a different email to sign up to my website than the one they use for paypal? I could use the payer_id but run into a similar issue. I don't have the payer_id linked to the email they used to sign up to my website. And the emails may not be the same. I could first see if they use the same email, link the notifications to the user if they do, then have them input their paypal email if I can't find it but that seems horribly insecure. I could send an email to their paypal email asking them to sign in to my website with a token link but that seems like requiring too much user interaction.
Thanks in advance for any advice!
