I am trying to integrate payment gateway with Paypal express. the issue is the payment gateway sends post data from paypal express checkout back to a specific URL in our ExpressionEngine but does not contain the parameter XID which is required by ExpressionEngine secure formS as of version 2.7.x

is there a way to accept the incoming post from external website without disabling the settings: $config['secure_form'] = 'n';


1 Answer 1


You must create a module and a module action. There are docs here. The key is to grant your action a CSRF exemption, like so:

ee()->db->insert('actions', array(
  'class' => 'Module_name' ,
  'method' => 'method_to_call',
  'csrf_exempt' => 1,

Look up the action_id in the exp_actions table for your newly created action. Your action can now be triggered via url without XID at http://yoursite.com/?ACT=XX, where XX is your action_id.

  • This is not working for SagePay Offsite module, still get "The action you have requested is invalid." Jun 3, 2014 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.