title: Identity Token is NOT required for PayPal's Payment Data Transfer (PDT)?
body: <p>I've setup a PayPal site which uses IPN and I was having trouble getting PayPal to send the GET variables to the return URL that I had specified. It was sending the user's browser to the return URL, but nothing was being passed via GET or POST.</p>
  
  <p>I changed one setting in the PayPal business account: "Payment Data Transfer (optional)" to On which generated an "Identity Token" on the PayPal website.</p>
  
  <p>I also got an automated email from PayPal saying:</p>
  
  <pre><code>---------- Forwarded message ----------
  From: service@paypal.com &lt;service@paypal.com&gt;
  Subject: Payment Data Transfer (PDT) Has Been Enabled
  
  This email is to inform you that you have successfully enabled Payment Data Transfer.
  
  PDT's primary function is to display payment transaction details to buyers when they are redirected back to your site upon payment completion. However, there are cases, such as with pending transactions, where you won't receive notification of all transactions. For this reason, PayPal strongly recommends that you also enable Instant Payment Notification (IPN).
  
  To learn more about enabling and setting up IPN:
  https://www.paypal.com/us/cgi-bin/?cmd=p/xcl/rec/ipn-intro-outside
  
  To learn more about Payment Data Transfer, including setup instructions and a complete list of variables:
  https://www.paypal.com/us/cgi-bin/?cmd=p/xcl/rec/pdt-intro-outside
  
  Sincerely,
  PayPal
  </code></pre>
  
  <p>Clicking on the second link and clicking on "Technical Overview" (https://www.paypal.com/us/cgi-bin/webscr?cmd=p/xcl/rec/pdt-techview-outside) shows:</p>
  
  <blockquote>
    <p>Your POST should be sent to
    <a href="https://www.paypal.com/cgi-bin/webscr" rel="nofollow">https://www.paypal.com/cgi-bin/webscr</a>.
    You must post the transaction token
    using the variable "tx" and the value
    of the transaction token previously
    received (e.g.
    "tx=transaction_token"), and the
    special identity token using the
    variable at and the value of your PDT
    identity token (e.g.
    "at=identity_token"). You will also
    need to append a variable named "cmd"
    with the value "_notify-synch", for
    example "cmd=_notify-synch", to the
    POST string.</p>
  </blockquote>
  
  <p>However, I am NOT passing the Identity Token at all, yet everything is working fine! </p>
  
  <pre><code>(a) Is this a problem?
  (b) Why is it working if the documentation implies that it shouldn't?
  (c) Is this a consequence of specifying an outdated API version (58.0)? What is the value I should be using?
  </code></pre>