How to handle multiple environments: dev, staging and production with paypal webhooks?

Create a Class like below to keep in the beginning of your application. Let it initialize once.

class App {
    private static $env_status = null;
    private static $paypal_settings = [];

    const ENV_PRODUCTION = "production";
    const ENV_STAGING = "staging";
    const ENV_DEV = "development";

    public static function init() {
        // Set environment status.  
        // You can also parse domain name and depending on your domain, you can set the environment status.
        self::$env_status = getenv("ENV_STATUS");   // getenv() Gets from Environment variable. You'll need set clear_env = no in php config for this to work.

        switch(self::$env_status) {
            case App::ENV_PRODUCTION:
                self::$paypal_settings = [
                    "mode" => "live"
                    "clientID" => "PRODUCTION_CLIENT_ID" ,
                    "secret" => "PRODUCTION_SECRET" ,
                    "currency" => "USD",
                    "webhook" => "https://example.com/live_webhook_endpoint"
                ];

                break;

            case App::ENV_STAGING:
                self::$paypal_settings = [
                    "mode"=> "sandbox"
                    "clientID"=> "STAGING_CLIENT_ID" ,
                    "secret"=> "STAGING_SECRET" ,
                    "currency"=> "USD",
                    "webhook" => "https://example.com/staging_webhook_endpoint"
                ];

                break;

            default:
                // ENV_DEV settings
                self::$paypal_settings = [
                    "mode"=> "sandbox"
                    "clientID"=> "DEVELOPMENT_CLIENT_ID" ,
                    "secret"=> "DEVELOPMENT_SECRET" ,
                    "currency"=> "USD",
                    "webhook" => "https://example.com/development_webhook_endpoint"
                ];
                break;
        }
    }

    public static function env_status() {
        return self::$env_status;
    }

    public static function paypal_settings() {
        return self::$paypal_settings;
    }

    // You can also create seprate function if you just want webhook URL. 
    // You can define in different variable also if that's the case.
    public static function paypal_webhook_url() {
        return self::$paypal_settings['webhook'];
    }

} App::init();

Then whenever you want to get paypal settings you can call it from anywhere in your Application.

$paypay_settings = App::paypal_settings();

OR if you need just paypal webhook URL

$paypal_webhook_url = App::paypal_webhook_url();

This way you don't have to keep any conditions in other parts of your code. All the conditions will go in a single place, which will be easier to update later.

How does paypal handle multiple webhook urls.

You will need to hit PayPal Sandbox URL to hit for staging/development environment.

What status code should be returned if environment is not correct?

HTTP 400. Since it will be an invalid request.

Ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400

The HyperText Transfer Protocol (HTTP) 400 Bad Request response status code indicates that the server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).

On one of our projetcs, we use different configuration variables depending on the environnement.

For dev

$config['paypal.settings'] = array(
        'mode'=> "sandbox", //'live' or 'sandbox'(default)
        'clientID'=>"CLIENT_ID_FOR_DEV" ,
        'secret'=> "SUPERSECRETCLIENT_SECRET_FOR_DEV" ,
        'currency'=>'EUR',
        'logEnabled' => false,
        'logDir'=>__DIR__ . '/../logs'
);

For prod :

$config['paypal.settings'] = array(
        'mode'=> "live", 
        'clientID'=>"CLIENT_ID_FOR_PROD" ,
        'secret'=> "SUPERSECRETCLIENT_SECRET_FOR_PROD" ,
        'currency'=>'EUR',
        'logEnabled' => false,
        'logDir'=>__DIR__ . '/../logs'
);

and our dev and prod environnement are obviously on 2 different domains that are configured for each CLIENT_ID on the paypal interface.

In the webhook controller called by Paypal we have :

class WebhookController{
  function paypalPingBackAction($request){
      $paypalSettings = //get paypal settings
      $isLive = ($paypalSettings["sandbox"] ?? "sandbox") == "live";

      $currentDomain = $request->getDomain();

     // now we have enough information (domain and sandbox)
     // to do things accordingly

  }
}

Paypal does not really care about what code you send back. But if you send a 500, he will retry later. So maybe, if things go well, just return an empty 201 accepted !