I am writing a payments system based around paypal, I am using the HTML 'API'.

I am passing the following form fields to PayPal:

• 'rm' => 2
• 'return => http://www.example.com/payment-handler.php?token=sometoken

Where 'token' is a token I generated.

According to the paypal documentation, a return method (rm) of 2 indicates to Paypal that the transaction data be posted back to the callback url using the POST method.

When processing items using 'buy_now' buttons, the transaction items are correctly POSTed to my callback url (payment-handler.php), but for 'subscribe' operations, although the callback url is called, no POST data is sent to the url, and also, the 'token' field is missing. Instead, there is a parameter called 'auth'.

I cant see anything in the paypal docs about a 'auth' field - so I dont know whats generating it and if I can reliably using it. Can anyone shed some light on this?