A ministry’s web store and its reader both offer PayPal, and both go through one app set here. The client id is public and the secret is not; both are needed before either can take a payment.
Open the tenant’s PayPal panel.
Give the client id and the secret together.
The worker checks the pair with PayPal; neither is saved unless both are right.
Set live and sandbox separately.
As with Stripe, a sandbox app cannot take real money.