That is a really good question and one that I'm a bit confused about myself. The token is, I believe, an identity token I got from PayPal.
I looked through the setup of what I have used in the past and I may not actually be using the token. The interface for the extension (BreezingForms) asks for the "token" and the tooltip says it is used for IPN. I modified the submission process for the extension a few years ago. I believe it was to allow for the submission of several items as opposed to a single payment amount.
That said, the URL for submission is
www.paypal.com/cgi-bin/webscr
. In the post, cmd="_cart", upload="1" and rm is a specific confirmation url for the form processor (again BreezingForms) with IPN enabled. The other post items are transaction details (shipping, tax, business name etc) and the individual cart items and prices.
It may be that this token is not sent with the cart, but confirmed in the response from PayPal—I'm really grasping at straws with that one though.
Does that help? If not I may just have to trial and error my way through some of it until I have a better idea of what to ask. As a side question, do you know what the difference is between using and identity token and not using it is? From what I researched today, it sounds like it may be safer (avoids customer intercepting the response) to use the token.
Thanks!
Tim