Hi KarelCemus,
It's not only with ENCRYPTED. If you try CLEARTEXT, the same error is thrown.
Upload cart is a slightly different kind of button, that was never intended to be pre-built, and that's why this functionality doesn't exist in BMCreateButton. If you compare the Button Manager in the account and the API functionality - they have the same capabilities and, in both cases, the upload cart isn't there.
Looking at the documentation, you will also notice the BUTTONTYPE=CART refers to Add to cart.
It makes perfect sense to try to secure the upload cart code, but the best way will always be post-transaction consistency verification (with IPN).
... View more