title: PayPal REST API: Make requests on behalf of a merchant
body: <p>I'm in the process of migrating our software, which makes requests on behalf of merchants to PayPal using the PayPal SOAP API, to the PayPal REST API infrastructure.</p>
  
  <p>I'm using the Client ID / Secret of my PayPal developer account to get a Bearer token from the Sandbox, using <a href="https://api.sandbox.paypal.com/v1/oauth2/token" rel="nofollow noreferrer">https://api.sandbox.paypal.com/v1/oauth2/token</a>.</p>
  
  <p>Then I'm doing a call to <a href="https://api.sandbox.paypal.com/v2/checkout/orders" rel="nofollow noreferrer">https://api.sandbox.paypal.com/v2/checkout/orders</a>, using our the bearer token just got, to make requests on behalf of a merchant. I'm using the <a href="https://developer.paypal.com/docs/api/reference/api-requests/#paypal-auth-assertion" rel="nofollow noreferrer">PayPal-Auth-Assertion</a> header with the following (encoded) JWT-Token:</p>
  
  <pre><code>Header:
      {
    "typ": "JWT",
    "alg": "HS256"
  }
  Body: {
    "email": "[merchant e-mail]",
    "iss": "[my client id]"
  }
  </code></pre>
  
  <p>The "merchant e-mail" is one of the sandbox accounts I opened in <a href="https://developer.paypal.com/developer/accounts/" rel="nofollow noreferrer">https://developer.paypal.com/developer/accounts/</a></p>
  
  <p>In return I get a <code>(400) Bad Request {"error":"invalid_request","error_description":"No permissions to set target_client_id"}</code>.</p>
  
  <p>It seems like there must be an additional step for the sandbox account to grant permissions to the developer account. For the SOAP API, I could add the user name of a 3rd party in the following screen <a href="https://i.stack.imgur.com/QDVg7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QDVg7.png" alt="enter image description here"></a>. Then I could use the same username as header value for <code>X-PAYPAL-SECURITY-USERID</code>. However, I cannot seem to link the sandbox account in the same way, because there is no "third party username" for the main account (the one I'm getting the Client ID from).</p>
  
  <p>What exactly has to be configured to allow these types of 3rd party calls for REST API?</p>