PayPal REST token request: api.paypal.com OK, api-m fails - paypal

Question

Addendum 2:The Mozilla behavior is specific to which host the URL resolves to; I've added curl script showing this at the end of the Question.
Addendum: This had gone away 8 hours later or so, and worked for several days. But a week later, I re-run the page just to check, and it is failing repeatedly again: api.paypal works, api-m.paypal doesn not.
I receive different results requesting a live-site access token from api-m.paypal.com and api.paypal.com. If I make the request to api.paypal.com, it works and a token is returned. If I request it from api-m.paypal.com, I receive a 403 Forbidden error. How is this possible? In general, and for token requests, the documentation seems to use api and api-m interchangeably. What's the difference between the two and what calls should be routed to api vs api-m? When I'm running my whole store on the sandbox, everything goes to api-m and works fine. In a test program that just requests tokens repeatedly, sequencing through api, api-m, api.sandbox, and api-m.sandbox --- only api-m fails, the other 3 cases are good. I saw an api vs api-m discussion once but can't find it again; pretty sure it didn't mention this!
<?php
include("../_private/ppinfo.php");
header('Content-type: text/plain');
$sandbox = 0;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 1;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 2;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = -1;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 0;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = -1;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 1;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 0;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
$sandbox = 2;
echo "sandbox $sandbox rv " . GetNewPPToken($sandbox) . "\n";
// Get a paypal REST token to use for the rest of our transactions.
// See https://developer.paypal.com/docs/business/get-started/
function GetNewPPToken($sandbox)
{
global $G, $ppinfo;
$headers = array(
"Accept: application/json",
"Accept-Language: en_US",
"Content-Type: application/x-www-form-urlencoded"
);
if ($sandbox > 1)
{
$clid = $ppinfo['sb_acct'];
$secret = $ppinfo['sb_secr'];
$url = "https://api.sandbox.paypal.com/v1/oauth2/token";
}
else if ($sandbox > 0)
{
$clid = $ppinfo['sb_acct'];
$secret = $ppinfo['sb_secr'];
$url = "https://api-m.sandbox.paypal.com/v1/oauth2/token";
}
else if ($sandbox < 0)
{
$clid = $ppinfo['acct'];
$secret = $ppinfo['secr'];
$url = "https://api.paypal.com/v1/oauth2/token";
}
else
{
$clid = $ppinfo['acct'];
$secret = $ppinfo['secr'];
$url = "https://api-m.paypal.com/v1/oauth2/token";
};
$cvt = "grant_type=client_credentials";
$curl = newPPcurl($url, $cvt, $headers);
curl_setopt($curl, CURLOPT_USERPWD, "$clid:$secret");
$resp = curl_exec($curl);
$err = curl_error($curl) ;
$json = json_decode($resp, true);
if (0)
{
echo "response:\n";
print_r($resp);
echo "err:\n";
print_r($err);
echo "token '" . $ppinfo['token'] . "'\n";
};
$ppinfo['token'] = $json['access_token'];
return ($ppinfo['token'] != '' ? 1 : 0);
}
function newPPcurl($url, $flds, $hdrs)
{
$user_agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_POST, 1);
if ($flds != '')
curl_setopt($curl, CURLOPT_POSTFIELDS, $flds);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FORBID_REUSE, 1);
curl_setopt($curl, CURLOPT_USERAGENT, $user_agent);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2); // or 2?
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, TRUE);
//curl_setopt($curl, CURLOPT_SSLCERT, $pem); // pem file name
curl_setopt($curl, CURLOPT_TIMEOUT, 30);
curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 30);
if ($hdrs != "")
curl_setopt($curl, CURLOPT_HTTPHEADER, $hdrs);
return $curl;
}
Test output:
sandbox 0 rv 0
sandbox 1 rv 1
sandbox 2 rv 1
sandbox -1 rv 1
sandbox 0 rv 0
sandbox -1 rv 1
sandbox 1 rv 1
sandbox 0 rv 0
sandbox 2 rv 1
Here's some curl commands that show this behavior. When api-m.paypal.com resolves to 184.87.90.6, the token is fetched OK with the Mozilla agent (cmd #1). When the IP resolves to 151.101.1.35, the request fails for Mozilla (cmd#2), passes for curl (cmd#3). Note that you'll have to supply your own id:pwd strings to test.
curl -v https://api-m.paypal.com/v1/oauth2/token \
--user-agent "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" \
--resolve api-m.paypal.com:443:184.87.90.6 \
-H "Accept: application/json" \
-H "Accept-Language: en_US" \
-u "<id:pwd>" \
-d "grant_type=client_credentials"
curl -v https://api-m.paypal.com/v1/oauth2/token \
--user-agent "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" \
--resolve api-m.paypal.com:443:151.101.1.35 \
-H "Accept: application/json" \
-H "Accept-Language: en_US" \
-u "<id:pwd>" \
-d "grant_type=client_credentials"
curl -v https://api-m.paypal.com/v1/oauth2/token \
--user-agent "curl/7.55.1" \
--resolve api-m.paypal.com:443:151.101.1.35 \
-H "Accept: application/json" \
-H "Accept-Language: en_US" \
-u "<id:pwd>" \
-d "grant_type=client_credentials"

Answer 1

The PayPal REST token request's user-agent must be a curl identifier, such as "curl/7.55.1". Using a Mozilla user agent causes 403 FORBIDDEN on api-m.paypal.com, though it will appear to work on api.paypal.com, api.sandbox.paypal.com, and api-m.sandbox.paypal.com