From https://developer.paypal.com/docs/subscriptions/integrate/#4-create-a-subscription
I know we can create subscription use different way.
The smart button way is easy to understand. (After the pop windows , client login or use credit card subscription ) And returning the subscription id.
The server can check the subscription id.
But for the subscription api way.
We only need to know
"subscriber": { "name": { "given_name": "John", "surname": "Doe" }, "email_address": "xxx" },
I am not sure how my api server can make sure or paypal server can make sure the email_address and the name is belong the client ?
My website just collect the name and email then it can create subscription? (No password need for paypal login in ?)
My double is the client people can input another email and username , then server side use this valid name and email can create subscription and give it to the wrong person?
What's the missing understanding here ?
