PayPal AI

Inspiration

Small merchants and solo founders already use PayPal to get paid, but almost everything around the payment is manual:

Getting online takes days: building a store, writing copy, hosting it and wiring checkout.
Reacting to payments is copy-paste work across five tools: receipts, refunds, fraud checks, team alerts and bookkeeping.

We asked a simple question: what if an agent sat in front of PayPal? The merchant describes the business in plain language, and the agent builds the store and the automations.

The hard part was trust. Nobody wants an AI that can publish a site or move money on its own, so the whole product is built around one rule:

Agents edit copies, humans approve.

What it does

PayPal AI is one web app with three connected modules:

#	Module	What it does
1	Web Store Builder + Site Agent	Chat to generate, edit and publish a hosted store with real PayPal Orders v2 checkout. Every agent step is shown live, with one-click Undo.
2	Workflow Builder + Flow Assistant	Drag-and-drop automations with 35 node types, triggered by PayPal events (payments, refunds, disputes). The assistant builds the flow from a sentence.
3	Store Manager	A ledger of money in and out, tagged B2B / B2C / C2B / G2C, fed by workflow runs.

Along the way it also handles PDF receipts, email, Telegram, Slack and Discord alerts, refunds and fraud checks, with webhook signature verification and a full audit trail of every agent turn.

How we built it

Layer	Technology
Frontend	Vanilla JavaScript, single-file app, no build step (Vercel)
Backend	Node.js + Express 4 (Render)
Payments	PayPal Orders v2, Webhooks, Refunds, Disputes, Transaction Search
AI	Groq (`gpt-oss-120b` with fallback models)
Database	Supabase
Auth	Firebase Authentication
Images	Cloudinary
Email	Resend
Alerts	Telegram, Slack, Discord

The core pattern is a bounded tool-calling loop. The agent never touches the live store. It edits a private copy, and every tool result is re-validated by the same sanitizer the renderer uses (sanitizeSpec()), so the output is always a valid, escaped, renderable store.

If the number of steps in one agent turn is $t$, the loops are capped as

$$t \le T_{\text{site}} = 14 \qquad \text{and} \qquad t \le T_{\text{flow}} = 30$$

which keeps latency and cost predictable and prevents runaway loops. Publishing, and any action that moves money, needs explicit human approval.

Challenges we ran into

Keeping AI output safe. Letting a model write a storefront is risky. Typed tools, a strict sanitizer and server-side HTML escaping mean the model can only produce what the renderer accepts.
Rate limits and reliability. One model or key hitting a 429 should not break the product, so we built a fallback chain across models and keys. If each attempt fails independently with probability $p$ and there are $n$ model/key options, then

$$P(\text{all fail}) \approx p^{\,n}$$

which falls off quickly as $n$ grows. This is an idealized estimate, but it guided the design.

Secrets in chat. Users paste bot tokens and API keys into conversations. Secrets are scrubbed before anything reaches a model or a log, and Telegram tokens are verified and sealed with AES-256-GCM before the model is called.
Webhooks need a public URL. PayPal can only deliver events to a reachable endpoint, so local development needed tunnels and production needed a stable Render URL.
Surviving restarts. Render restarts services, which would silently delete in-memory automations. Workflows and receipts are persisted to Supabase and rehydrated on boot, so old receipt links keep working.
Making agents transparent. Streaming the plan, each tool call and exactly what changed took careful design, but it is what makes the agent feel trustworthy rather than magical.

Accomplishments that we're proud of

A store that goes from one sentence to a live PayPal checkout, with full Undo.
Agents that act on PayPal safely: they cannot publish, charge or send money without approval, and test runs are always dry runs.
Production details such as webhook signature verification, encrypted credentials, rate limiting and an audit trail of every agent turn.

What we learned

Typed, validated tools make agents far more reliable than free-form generation.
Human approval is a feature, not friction. It is what makes people comfortable letting an agent near payments.
Graceful degradation matters. Every optional integration can be missing and the app still runs.
Production details such as restarts, rate limits and webhooks take as much effort as the AI itself.