diff --git a/assets/js/gateways/paypal-rest.js b/assets/js/gateways/paypal-rest.js
new file mode 100644
index 000000000..2fec0613f
--- /dev/null
+++ b/assets/js/gateways/paypal-rest.js
@@ -0,0 +1,134 @@
+/**
+ * PayPal REST Gateway - Checkout Branding.
+ *
+ * Styles the checkout submit button with official PayPal branding
+ * when PayPal is the active payment method.
+ *
+ * Per PayPal integration guidelines, PayPal buttons must be presented
+ * with equal prominence and official logos from approved sources.
+ */
+/* global wp */
+( function () {
+
+	'use strict';
+
+	const GATEWAY_ID = 'paypal-rest';
+	const STYLE_ID = 'wu-paypal-btn-style';
+	const ICON_CLASS = 'wu-paypal-btn-icon';
+
+	// Small PayPal "P" favicon from PayPal's CDN — square, won't overlap text.
+	const ICON_URL = 'https://www.paypalobjects.com/webstatic/icon/pp258.png';
+
+	/**
+	 * Inject CSS for PayPal button colours.
+	 * Using a <style> block so colours survive Vue re-renders (spinner swaps).
+	 *
+	 * @param {boolean} active
+	 */
+	function setButtonColors( active ) {
+		const existing = document.getElementById( STYLE_ID );
+
+		if ( active && ! existing ) {
+			const style = document.createElement( 'style' );
+			style.id = STYLE_ID;
+			style.textContent = [
+				'#wu_form [type="submit"].button {',
+				'  background-color: #FFC439 !important;',
+				'  color: #003087 !important;',
+				'  border-color: #FFC439 !important;',
+				'  font-weight: 700 !important;',
+				'}',
+				'#wu_form [type="submit"].button:hover,',
+				'#wu_form [type="submit"].button:focus {',
+				'  background-color: #f0b429 !important;',
+				'  border-color: #f0b429 !important;',
+				'}',
+				'#wu_form [type="submit"].button .' + ICON_CLASS + ' {',
+				'  display: inline-block;',
+				'  width: 20px;',
+				'  height: 20px;',
+				'  vertical-align: middle;',
+				'  margin-right: 8px;',
+				'  margin-bottom: 2px;',
+				'  object-fit: contain;',
+				'}',
+			].join( '\n' );
+			document.head.appendChild( style );
+		} else if ( ! active && existing ) {
+			existing.remove();
+		}
+	}
+
+	/**
+	 * Add or remove the PayPal icon inside each submit button.
+	 *
+	 * @param {boolean} active
+	 */
+	function setButtonIcons( active ) {
+		const form = document.getElementById( 'wu_form' );
+		if ( ! form ) {
+			return;
+		}
+
+		const buttons = form.querySelectorAll( '[type="submit"].button' );
+
+		buttons.forEach( function ( btn ) {
+			const existing = btn.querySelector( '.' + ICON_CLASS );
+
+			if ( active && ! existing ) {
+				const img = document.createElement( 'img' );
+				img.src = ICON_URL;
+				img.alt = '';
+				img.className = ICON_CLASS;
+				img.setAttribute( 'aria-hidden', 'true' );
+				img.setAttribute( 'loading', 'lazy' );
+				btn.prepend( img );
+			} else if ( ! active && existing ) {
+				existing.remove();
+			}
+		} );
+	}
+
+	/**
+	 * Apply or remove all PayPal button branding.
+	 *
+	 * @param {boolean} active
+	 */
+	function applyBranding( active ) {
+		setButtonColors( active );
+		setButtonIcons( active );
+	}
+
+	/**
+	 * Re-apply icon after Vue re-renders the button (e.g. spinner swap).
+	 * The CSS survives re-renders; only the icon DOM node needs re-injection.
+	 */
+	( function watchForRerender() {
+		let isPayPalActive = false;
+
+		const observer = new MutationObserver( function () {
+			if ( isPayPalActive ) {
+				setButtonIcons( true );
+			}
+		} );
+
+		wp.hooks.addAction(
+			'wu_on_change_gateway',
+			'wp-ultimo/paypal-rest',
+			function ( newGateway ) {
+				isPayPalActive = ( newGateway === GATEWAY_ID );
+				applyBranding( isPayPalActive );
+
+				const form = document.getElementById( 'wu_form' );
+				if ( form ) {
+					if ( isPayPalActive ) {
+						observer.observe( form, { childList: true, subtree: true } );
+					} else {
+						observer.disconnect();
+					}
+				}
+			}
+		);
+	}() );
+
+}() );
diff --git a/inc/admin-pages/class-dashboard-admin-page.php b/inc/admin-pages/class-dashboard-admin-page.php
index 6679b6190..94c9b5bb7 100644
--- a/inc/admin-pages/class-dashboard-admin-page.php
+++ b/inc/admin-pages/class-dashboard-admin-page.php
@@ -390,15 +390,46 @@ public function output_widget_most_visited_sites(): void {
 	 */
 	public function output_widget_revenues($unknown = null, $metabox = null): void {
 
+		$mrr           = wu_calculate_mrr();
+		$gross_revenue = wu_calculate_revenue($this->start_date, $this->end_date);
+		$refunds       = wu_calculate_refunds($this->start_date, $this->end_date);
+
+		$base_currency = wu_get_setting('currency_symbol', 'USD');
+
+		/**
+		 * Filters a revenue amount displayed on the dashboard.
+		 *
+		 * Allows addons (e.g. multi-currency) to convert amounts
+		 * to the base currency for consistent reporting.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param float  $amount   The revenue amount.
+		 * @param string $currency The currency of the amount.
+		 * @return float
+		 */
+		$mrr           = apply_filters('wu_dashboard_revenue_amount', $mrr, $base_currency);
+		$gross_revenue = apply_filters('wu_dashboard_revenue_amount', $gross_revenue, $base_currency);
+		$refunds       = apply_filters('wu_dashboard_revenue_amount', $refunds, $base_currency);
+
 		wu_get_template(
 			'dashboard-statistics/widget-revenue',
 			[
-				'mrr'           => wu_calculate_mrr(),
-				'gross_revenue' => wu_calculate_revenue($this->start_date, $this->end_date),
-				'refunds'       => wu_calculate_refunds($this->start_date, $this->end_date),
+				'mrr'           => $mrr,
+				'gross_revenue' => $gross_revenue,
+				'refunds'       => $refunds,
 				'product_stats' => wu_calculate_financial_data_by_product($this->start_date, $this->end_date),
 			]
 		);
+
+		/**
+		 * Fires after the revenue widget is rendered on the dashboard.
+		 *
+		 * Allows addons to append additional information (e.g. exchange rate status).
+		 *
+		 * @since 2.3.0
+		 */
+		do_action('wu_dashboard_after_revenue_widget');
 	}
 
 	/**
diff --git a/inc/admin-pages/class-settings-admin-page.php b/inc/admin-pages/class-settings-admin-page.php
index a2adaf9aa..f1e5b92a2 100644
--- a/inc/admin-pages/class-settings-admin-page.php
+++ b/inc/admin-pages/class-settings-admin-page.php
@@ -627,6 +627,16 @@ public function default_view(): void {
 		);
 
 		$form->render();
+
+		/**
+		 * Fires after a settings section's form is rendered.
+		 *
+		 * The dynamic portion of the hook name, `$section_slug`, refers to the
+		 * settings section slug (e.g. 'multi-currency', 'payment-gateways').
+		 *
+		 * @since 2.3.0
+		 */
+		do_action("wu_settings_{$section_slug}_after");
 	}
 
 	/**
diff --git a/inc/checkout/class-cart.php b/inc/checkout/class-cart.php
index 812bbe362..b6bad6691 100644
--- a/inc/checkout/class-cart.php
+++ b/inc/checkout/class-cart.php
@@ -1784,6 +1784,21 @@ public function add_product($product_id_or_slug, $quantity = 1): bool {
 		$duration      = $product->get_duration();
 		$duration_unit = $product->get_duration_unit();
 
+		/**
+		 * Filters the product amount when it is added to the cart.
+		 *
+		 * Allows addons (e.g. multi-currency) to convert the product
+		 * price to a different currency before line items are created.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param float                       $amount  The product amount.
+		 * @param \WP_Ultimo\Models\Product   $product The product being added.
+		 * @param \WP_Ultimo\Checkout\Cart    $cart    The cart instance.
+		 * @return float
+		 */
+		$amount = apply_filters('wu_cart_product_amount', $amount, $product, $this);
+
 		/*
 		 * Deal with price variations.
 		 *
@@ -1934,7 +1949,24 @@ public function add_product($product_id_or_slug, $quantity = 1): bool {
 		/**
 		 * Signup Fees
 		 */
-		if (empty($product->get_setup_fee())) {
+		$setup_fee = $product->get_setup_fee();
+
+		/**
+		 * Filters the product setup fee when it is added to the cart.
+		 *
+		 * Allows addons (e.g. multi-currency) to convert the setup fee
+		 * to a different currency before the line item is created.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param float                       $setup_fee The product setup fee.
+		 * @param \WP_Ultimo\Models\Product   $product   The product being added.
+		 * @param \WP_Ultimo\Checkout\Cart    $cart      The cart instance.
+		 * @return float
+		 */
+		$setup_fee = apply_filters('wu_cart_product_setup_fee', $setup_fee, $product, $this);
+
+		if (empty($setup_fee)) {
 			return true;
 		}
 
@@ -1956,7 +1988,7 @@ public function add_product($product_id_or_slug, $quantity = 1): bool {
 		}
 
 		// translators: placeholder is the product name.
-		$description = ($product->get_setup_fee() > 0) ? __('Signup Fee for %s', 'ultimate-multisite') : __('Signup Credit for %s', 'ultimate-multisite');
+		$description = ($setup_fee > 0) ? __('Signup Fee for %s', 'ultimate-multisite') : __('Signup Credit for %s', 'ultimate-multisite');
 
 		$description = sprintf($description, $product->get_name());
 
@@ -1979,7 +2011,7 @@ public function add_product($product_id_or_slug, $quantity = 1): bool {
 				'title'       => $description,
 				'taxable'     => $product->is_taxable(),
 				'recurring'   => false,
-				'unit_price'  => $product->get_setup_fee(),
+				'unit_price'  => $setup_fee,
 				'quantity'    => $quantity,
 			],
 			$product,
@@ -2884,7 +2916,19 @@ public function get_plan_id() {
 	 */
 	public function get_currency() {
 
-		return $this->currency;
+		/**
+		 * Filters the cart currency.
+		 *
+		 * Allows addons (e.g. multi-currency) to override the currency
+		 * used for the current cart/checkout session.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param string                     $currency The current currency code.
+		 * @param \WP_Ultimo\Checkout\Cart   $cart     The cart instance.
+		 * @return string
+		 */
+		return apply_filters('wu_cart_get_currency', $this->currency, $this);
 	}
 
 	/**
diff --git a/inc/gateways/class-base-gateway.php b/inc/gateways/class-base-gateway.php
index 35974ea1f..fb7d5ec50 100644
--- a/inc/gateways/class-base-gateway.php
+++ b/inc/gateways/class-base-gateway.php
@@ -563,9 +563,12 @@ public function process_confirmation() {}
 	 * @since 2.0.0
 	 *
 	 * @param string $gateway_payment_id The gateway payment id.
-	 * @return void|string
+	 * @return string
 	 */
-	public function get_payment_url_on_gateway($gateway_payment_id) {}
+	public function get_payment_url_on_gateway($gateway_payment_id): string {
+		unset($gateway_payment_id);
+		return '';
+	}
 
 	/**
 	 * Returns the external link to view the membership on the membership gateway.
@@ -575,9 +578,12 @@ public function get_payment_url_on_gateway($gateway_payment_id) {}
 	 * @since 2.0.0
 	 *
 	 * @param string $gateway_subscription_id The gateway subscription id.
-	 * @return void|string.
+	 * @return string
 	 */
-	public function get_subscription_url_on_gateway($gateway_subscription_id) {}
+	public function get_subscription_url_on_gateway($gateway_subscription_id): string {
+		unset($gateway_subscription_id);
+		return '';
+	}
 
 	/**
 	 * Returns the external link to view the membership on the membership gateway.
@@ -587,9 +593,12 @@ public function get_subscription_url_on_gateway($gateway_subscription_id) {}
 	 * @since 2.0.0
 	 *
 	 * @param string $gateway_customer_id The gateway customer id.
-	 * @return void|string.
+	 * @return string
 	 */
-	public function get_customer_url_on_gateway($gateway_customer_id) {}
+	public function get_customer_url_on_gateway($gateway_customer_id): string {
+		unset($gateway_customer_id);
+		return '';
+	}
 
 	/**
 	 * Reflects membership changes on the gateway.
diff --git a/inc/gateways/class-base-paypal-gateway.php b/inc/gateways/class-base-paypal-gateway.php
new file mode 100644
index 000000000..4468da855
--- /dev/null
+++ b/inc/gateways/class-base-paypal-gateway.php
@@ -0,0 +1,300 @@
+<?php
+/**
+ * Base PayPal Gateway.
+ *
+ * Base class for PayPal payment gateways. Should be extended by specific PayPal implementations.
+ * Follows the same pattern as Base_Stripe_Gateway for consistency.
+ *
+ * @package WP_Ultimo
+ * @subpackage Gateways
+ * @since 2.0.0
+ */
+
+namespace WP_Ultimo\Gateways;
+
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+/**
+ * Base PayPal Gateway class. Should be extended by PayPal gateway implementations.
+ *
+ * @since 2.0.0
+ */
+abstract class Base_PayPal_Gateway extends Base_Gateway {
+
+	/**
+	 * Allow gateways to declare multiple additional ids.
+	 *
+	 * These ids can be retrieved alongside the main id,
+	 * via the method get_all_ids().
+	 *
+	 * This allows hooks to work for both legacy and modern PayPal implementations.
+	 *
+	 * @since 2.0.0
+	 * @var array
+	 */
+	protected $other_ids = ['paypal', 'paypal-rest'];
+
+	/**
+	 * Partner Attribution ID (BN Code) for PayPal Partner Program tracking.
+	 *
+	 * This code identifies Ultimate Multisite as the integration partner
+	 * and enables partner revenue sharing and analytics.
+	 *
+	 * Apply for an official BN code at: https://www.paypal.com/partnerprogram
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $bn_code = 'ULTIMATE_SP_PPCP';
+
+	/**
+	 * Holds if we are in test mode.
+	 *
+	 * @since 2.0.0
+	 * @var bool
+	 */
+	protected $test_mode = true;
+
+	/**
+	 * Declares support to recurring payments.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function supports_recurring(): bool {
+
+		return true;
+	}
+
+	/**
+	 * Declares support to subscription amount updates.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function supports_amount_update(): bool {
+
+		return true;
+	}
+
+	/**
+	 * Returns the PayPal base URL based on test mode.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	protected function get_paypal_base_url(): string {
+
+		return $this->test_mode ? 'https://www.sandbox.paypal.com' : 'https://www.paypal.com';
+	}
+
+	/**
+	 * Returns the PayPal API base URL based on test mode.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	protected function get_api_base_url(): string {
+
+		return $this->test_mode ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
+	}
+
+	/**
+	 * Get the subscription description.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Checkout\Cart $cart The cart object.
+	 * @return string
+	 */
+	protected function get_subscription_description($cart): string {
+
+		$descriptor = $cart->get_cart_descriptor();
+
+		$desc = html_entity_decode(substr($descriptor, 0, 127), ENT_COMPAT, 'UTF-8');
+
+		return $desc;
+	}
+
+	/**
+	 * Returns the external link to view the payment on the payment gateway.
+	 *
+	 * Return an empty string to hide the link element.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $gateway_payment_id The gateway payment id.
+	 * @return string
+	 */
+	public function get_payment_url_on_gateway($gateway_payment_id): string {
+
+		if (empty($gateway_payment_id)) {
+			return '';
+		}
+
+		$sandbox_prefix = $this->test_mode ? 'sandbox.' : '';
+
+		return sprintf(
+			'https://www.%spaypal.com/activity/payment/%s',
+			$sandbox_prefix,
+			$gateway_payment_id
+		);
+	}
+
+	/**
+	 * Returns the external link to view the subscription on PayPal.
+	 *
+	 * Return an empty string to hide the link element.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $gateway_subscription_id The gateway subscription id.
+	 * @return string
+	 */
+	public function get_subscription_url_on_gateway($gateway_subscription_id): string {
+
+		if (empty($gateway_subscription_id)) {
+			return '';
+		}
+
+		$sandbox_prefix = $this->test_mode ? 'sandbox.' : '';
+
+		// Check if this is a REST API subscription ID (starts with I-) or legacy NVP profile ID
+		if (str_starts_with($gateway_subscription_id, 'I-')) {
+			// REST API subscription
+			return sprintf(
+				'https://www.%spaypal.com/billing/subscriptions/%s',
+				$sandbox_prefix,
+				$gateway_subscription_id
+			);
+		}
+
+		// Legacy NVP recurring payment profile
+		$base_url = 'https://www.%spaypal.com/us/cgi-bin/webscr?cmd=_profile-recurring-payments&encrypted_profile_id=%s';
+
+		return sprintf($base_url, $sandbox_prefix, $gateway_subscription_id);
+	}
+
+	/**
+	 * Returns whether a gateway subscription ID is from the REST API.
+	 *
+	 * REST API subscription IDs start with "I-" prefix.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $subscription_id The subscription ID to check.
+	 * @return bool
+	 */
+	protected function is_rest_subscription_id(string $subscription_id): bool {
+
+		return str_starts_with($subscription_id, 'I-');
+	}
+
+	/**
+	 * Adds partner attribution to API request headers.
+	 *
+	 * This should be called when making REST API requests to PayPal
+	 * to ensure partner tracking and revenue sharing.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $headers Existing headers array.
+	 * @return array Headers with partner attribution added.
+	 */
+	protected function add_partner_attribution_header(array $headers): array {
+
+		$headers['PayPal-Partner-Attribution-Id'] = $this->bn_code;
+
+		return $headers;
+	}
+
+	/**
+	 * Log a PayPal-related message.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $message The message to log.
+	 * @param string $level   Log level (default: 'info').
+	 * @return void
+	 */
+	protected function log(string $message, string $level = 'info'): void {
+
+		wu_log_add('paypal', $message, $level);
+	}
+
+	/**
+	 * Adds the necessary hooks for PayPal gateways.
+	 *
+	 * Child classes should call parent::hooks() and add their own hooks.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function hooks(): void {
+
+		// Add admin links to PayPal for membership management
+		add_filter('wu_element_get_site_actions', [$this, 'add_site_actions'], 10, 4);
+	}
+
+	/**
+	 * Adds PayPal-related actions to the site actions.
+	 *
+	 * Allows viewing subscription on PayPal for connected memberships.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array                        $actions    The site actions.
+	 * @param array                        $atts       The widget attributes.
+	 * @param \WP_Ultimo\Models\Site       $site       The current site object.
+	 * @param \WP_Ultimo\Models\Membership $membership The current membership object.
+	 * @return array
+	 */
+	public function add_site_actions($actions, $atts, $site, $membership) {
+
+		if (! $membership) {
+			return $actions;
+		}
+
+		$payment_gateway = $membership->get_gateway();
+
+		if (! in_array($payment_gateway, $this->other_ids, true)) {
+			return $actions;
+		}
+
+		$subscription_id = $membership->get_gateway_subscription_id();
+
+		if (empty($subscription_id)) {
+			return $actions;
+		}
+
+		$subscription_url = $this->get_subscription_url_on_gateway($subscription_id);
+
+		if (! empty($subscription_url)) {
+			$actions['view_on_paypal'] = [
+				'label'        => __('View on PayPal', 'ultimate-multisite'),
+				'icon_classes' => 'dashicons-wu-paypal wu-align-middle',
+				'href'         => $subscription_url,
+				'target'       => '_blank',
+			];
+		}
+
+		return $actions;
+	}
+
+	/**
+	 * Checks if PayPal is properly configured.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	abstract public function is_configured(): bool;
+
+	/**
+	 * Returns the connection status for display in settings.
+	 *
+	 * @since 2.0.0
+	 * @return array{connected: bool, message: string, details: array}
+	 */
+	abstract public function get_connection_status(): array;
+}
diff --git a/inc/gateways/class-base-stripe-gateway.php b/inc/gateways/class-base-stripe-gateway.php
index 3d1739481..5072d08e7 100644
--- a/inc/gateways/class-base-stripe-gateway.php
+++ b/inc/gateways/class-base-stripe-gateway.php
@@ -1998,6 +1998,21 @@ protected function build_stripe_cart($cart) {
 
 			$amount = $product->get_amount();
 
+			/**
+			 * Filters the recurring product amount used to create a Stripe plan.
+			 *
+			 * Allows addons (e.g. multi-currency) to convert the product
+			 * price before the Stripe plan/price is created.
+			 *
+			 * @since 2.5.0
+			 *
+			 * @param float                       $amount  The product amount.
+			 * @param \WP_Ultimo\Models\Product   $product The product.
+			 * @param \WP_Ultimo\Checkout\Cart    $cart    The cart instance.
+			 * @return float
+			 */
+			$amount = apply_filters('wu_stripe_cart_product_amount', $amount, $product, $cart);
+
 			$discount_code = $cart->get_discount_code();
 
 			if ($discount_code) {
@@ -2017,6 +2032,7 @@ protected function build_stripe_cart($cart) {
 						'price'          => $amount,
 						'interval'       => $product->get_duration_unit(),
 						'interval_count' => $product->get_duration(),
+						'currency'       => strtolower($cart->get_currency()),
 					]
 				);
 
diff --git a/inc/gateways/class-paypal-gateway.php b/inc/gateways/class-paypal-gateway.php
index 8f2bc9d88..99116d6c1 100644
--- a/inc/gateways/class-paypal-gateway.php
+++ b/inc/gateways/class-paypal-gateway.php
@@ -1,6 +1,13 @@
 <?php
 /**
- * PayPal Gateway.
+ * PayPal Gateway (Legacy NVP API).
+ *
+ * This gateway uses the legacy PayPal NVP (Name-Value Pair) API with
+ * username/password/signature authentication. This is maintained for
+ * backwards compatibility with existing integrations.
+ *
+ * For new integrations, use PayPal_REST_Gateway which uses the modern
+ * REST API with OAuth authentication.
  *
  * @package WP_Ultimo
  * @subpackage Gateways
@@ -10,7 +17,7 @@
 namespace WP_Ultimo\Gateways;
 
 use Psr\Log\LogLevel;
-use WP_Ultimo\Gateways\Base_Gateway;
+use WP_Ultimo\Gateways\Base_PayPal_Gateway;
 use WP_Ultimo\Database\Payments\Payment_Status;
 use WP_Ultimo\Database\Memberships\Membership_Status;
 
@@ -18,11 +25,11 @@
 defined('ABSPATH') || exit;
 
 /**
- * PayPal Payments Gateway
+ * PayPal Payments Gateway (Legacy NVP API)
  *
  * @since 2.0.0
  */
-class PayPal_Gateway extends Base_Gateway {
+class PayPal_Gateway extends Base_PayPal_Gateway {
 
 	/**
 	 * @var string
@@ -104,37 +111,37 @@ class PayPal_Gateway extends Base_Gateway {
 	protected $backwards_compatibility_v1_id = 'paypal';
 
 	/**
-	 * Declares support to recurring payments.
-	 *
-	 * Manual payments need to be manually paid,
-	 * so we return false here.
+	 * Checks if PayPal is properly configured with NVP credentials.
 	 *
 	 * @since 2.0.0
-	 * @return false
+	 * @return bool
 	 */
-	public function supports_recurring(): bool {
+	public function is_configured(): bool {
 
-		return true;
+		return ! empty($this->username) && ! empty($this->password) && ! empty($this->signature);
 	}
 
 	/**
-	 * Declares support to subscription amount updates.
-	 *
-	 * @since 2.1.2
-	 * @return true
-	 */
-	public function supports_amount_update(): bool {
-
-		return true;
-	}
-
-	/**
-	 * Adds the necessary hooks for the manual gateway.
+	 * Returns the connection status for display in settings.
 	 *
 	 * @since 2.0.0
-	 * @return void
+	 * @return array{connected: bool, message: string, details: array}
 	 */
-	public function hooks() {}
+	public function get_connection_status(): array {
+
+		$configured = $this->is_configured();
+
+		return [
+			'connected' => $configured,
+			'message'   => $configured
+				? __('PayPal credentials configured', 'ultimate-multisite')
+				: __('PayPal credentials not configured', 'ultimate-multisite'),
+			'details'   => [
+				'mode'     => $this->test_mode ? 'sandbox' : 'live',
+				'username' => ! empty($this->username) ? substr($this->username, 0, 10) . '...' : '',
+			],
+		];
+	}
 
 	/**
 	 * Initialization code.
@@ -417,7 +424,7 @@ public function process_membership_update(&$membership, $customer) {
 	 * @param \WP_Ultimo\Models\Customer   $customer The customer checking out.
 	 * @param \WP_Ultimo\Checkout\Cart     $cart The cart object.
 	 * @param string                       $type The checkout type. Can be 'new', 'retry', 'upgrade', 'downgrade', 'addon'.
-	 *
+	 * @throws \Exception When PayPal API call fails or returns an error.
 	 * @return void
 	 * @throws \Exception If something goes really wrong.
 	 * @since 2.0.0
@@ -650,7 +657,7 @@ public function process_checkout($payment, $membership, $customer, $cart, $type)
 				 *
 				 * Redirect to the PayPal checkout URL.
 				 */
-				wp_redirect($this->checkout_url . $body['TOKEN']); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect
+				wp_redirect($this->checkout_url . $body['TOKEN']); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- PayPal external URL
 
 				exit;
 			}
@@ -1427,23 +1434,6 @@ protected function create_recurring_profile($details, $cart, $payment, $membersh
 		}
 	}
 
-	/**
-	 * Get the subscription description.
-	 *
-	 * @since 2.0.0
-	 *
-	 * @param \WP_Ultimo\Checkout\Cart $cart The cart object.
-	 * @return string
-	 */
-	protected function get_subscription_description($cart) {
-
-		$descriptor = $cart->get_cart_descriptor();
-
-		$desc = html_entity_decode(substr($descriptor, 0, 127), ENT_COMPAT, 'UTF-8');
-
-		return $desc;
-	}
-
 	/**
 	 * Create a single payment on PayPal.
 	 *
@@ -1673,37 +1663,19 @@ public function get_checkout_details($token = '') {
 	/**
 	 * Returns the external link to view the payment on the payment gateway.
 	 *
-	 * Return an empty string to hide the link element.
+	 * For the legacy NVP API, there's no reliable payment link, so we return empty.
+	 * The base class provides a URL that may work for some transactions.
 	 *
 	 * @since 2.0.0
 	 *
 	 * @param string $gateway_payment_id The gateway payment id.
-	 * @return string.
+	 * @return string
 	 */
 	public function get_payment_url_on_gateway($gateway_payment_id): string {
 
 		return '';
 	}
 
-	/**
-	 * Returns the external link to view the membership on the membership gateway.
-	 *
-	 * Return an empty string to hide the link element.
-	 *
-	 * @since 2.0.0
-	 *
-	 * @param string $gateway_subscription_id The gateway subscription id.
-	 * @return string.
-	 */
-	public function get_subscription_url_on_gateway($gateway_subscription_id): string {
-
-		$sandbox_prefix = $this->test_mode ? 'sandbox.' : '';
-
-		$base_url = 'https://www.%spaypal.com/us/cgi-bin/webscr?cmd=_profile-recurring-payments&encrypted_profile_id=%s';
-
-		return sprintf($base_url, $sandbox_prefix, $gateway_subscription_id);
-	}
-
 	/**
 	 * Verifies that the IPN notification actually came from PayPal.
 	 *
diff --git a/inc/gateways/class-paypal-oauth-handler.php b/inc/gateways/class-paypal-oauth-handler.php
new file mode 100644
index 000000000..16df60f5f
--- /dev/null
+++ b/inc/gateways/class-paypal-oauth-handler.php
@@ -0,0 +1,665 @@
+<?php
+/**
+ * PayPal OAuth Handler.
+ *
+ * Handles the OAuth "Connect with PayPal" flow via a proxy server.
+ * The proxy holds the partner credentials securely; this handler
+ * communicates with the proxy to initiate onboarding and verify merchants.
+ *
+ * @package WP_Ultimo
+ * @subpackage Gateways
+ * @since 2.0.0
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use Psr\Log\LogLevel;
+
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+/**
+ * PayPal OAuth Handler class.
+ *
+ * @since 2.0.0
+ */
+class PayPal_OAuth_Handler {
+
+	use \WP_Ultimo\Traits\Singleton;
+
+	/**
+	 * Holds if we are in test mode.
+	 *
+	 * @since 2.0.0
+	 * @var bool
+	 */
+	protected $test_mode = true;
+
+	/**
+	 * Initialize the OAuth handler.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function init(): void {
+
+		$this->test_mode = (bool) (int) wu_get_setting('paypal_rest_sandbox_mode', true);
+
+		// Register AJAX handlers
+		add_action('wp_ajax_wu_paypal_connect', [$this, 'ajax_initiate_oauth']);
+		add_action('wp_ajax_wu_paypal_disconnect', [$this, 'ajax_disconnect']);
+
+		// Handle OAuth return callback
+		add_action('admin_init', [$this, 'handle_oauth_return']);
+	}
+
+	/**
+	 * Get the PayPal Connect proxy URL.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	protected function get_proxy_url(): string {
+
+		/**
+		 * Filters the PayPal Connect proxy URL.
+		 *
+		 * @since 2.0.0
+		 *
+		 * @param string $url Proxy server URL.
+		 */
+		return apply_filters(
+			'wu_paypal_connect_proxy_url',
+			'https://ultimatemultisite.com/wp-json/paypal-connect/v1'
+		);
+	}
+
+	/**
+	 * Returns the PayPal API base URL based on test mode.
+	 *
+	 * Used only for the access token call needed by the REST gateway
+	 * (merchant's own credentials, not partner credentials).
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	protected function get_api_base_url(): string {
+
+		return $this->test_mode ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
+	}
+
+	/**
+	 * AJAX handler to initiate OAuth flow via the proxy.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function ajax_initiate_oauth(): void {
+
+		check_ajax_referer('wu_paypal_oauth', 'nonce');
+
+		if (! current_user_can('manage_network_options')) {
+			wp_send_json_error(
+				[
+					'message' => __('You do not have permission to do this.', 'ultimate-multisite'),
+				]
+			);
+		}
+
+		// Update test mode from request if provided
+		if (isset($_POST['sandbox_mode'])) {
+			$this->test_mode = (bool) (int) $_POST['sandbox_mode'];
+		}
+
+		// Build the return URL
+		$return_url = add_query_arg(
+			[
+				'page'                 => 'wp-ultimo-settings',
+				'tab'                  => 'payment-gateways',
+				'wu_paypal_onboarding' => 'complete',
+			],
+			network_admin_url('admin.php')
+		);
+
+		$proxy_url = $this->get_proxy_url();
+
+		// Call the proxy to initiate the OAuth flow
+		$response = wp_remote_post(
+			$proxy_url . '/oauth/init',
+			[
+				'body'    => wp_json_encode(
+					[
+						'returnUrl' => $return_url,
+						'testMode'  => $this->test_mode,
+					]
+				),
+				'headers' => [
+					'Content-Type' => 'application/json',
+				],
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($response)) {
+			wu_log_add('paypal', 'Proxy init failed: ' . $response->get_error_message(), LogLevel::ERROR);
+
+			wp_send_json_error(
+				[
+					'message' => __('Could not reach the PayPal Connect service. Please check that your server can make outbound HTTPS requests and try again.', 'ultimate-multisite'),
+				]
+			);
+		}
+
+		$status_code = wp_remote_retrieve_response_code($response);
+		$data        = json_decode(wp_remote_retrieve_body($response), true);
+
+		if (200 !== $status_code || empty($data['actionUrl'])) {
+			$error_msg = $data['error'] ?? __('Failed to initiate PayPal onboarding', 'ultimate-multisite');
+			wu_log_add('paypal', 'Proxy init error: ' . $error_msg, LogLevel::ERROR);
+
+			wp_send_json_error(
+				[
+					'message' => $error_msg,
+				]
+			);
+		}
+
+		// Store the tracking ID locally for verification on return
+		$tracking_id = $data['trackingId'] ?? '';
+
+		if ($tracking_id) {
+			set_site_transient(
+				'wu_paypal_onboarding_' . $tracking_id,
+				[
+					'started'   => time(),
+					'test_mode' => $this->test_mode,
+				],
+				DAY_IN_SECONDS
+			);
+		}
+
+		wu_log_add('paypal', sprintf('OAuth initiated via proxy. Tracking ID: %s', $tracking_id));
+
+		wp_send_json_success(
+			[
+				'redirect_url' => $data['actionUrl'],
+				'tracking_id'  => $tracking_id,
+			]
+		);
+	}
+
+	/**
+	 * Handle the OAuth return callback.
+	 *
+	 * When the merchant completes the PayPal onboarding flow, they are redirected
+	 * back to WordPress with parameters indicating success/failure.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function handle_oauth_return(): void {
+
+		// Check if this is an OAuth return - nonce verification not possible for external OAuth callback
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- OAuth callback from PayPal
+		if (! isset($_GET['wu_paypal_onboarding']) || 'complete' !== $_GET['wu_paypal_onboarding']) {
+			return;
+		}
+
+		// Verify we're on the settings page
+		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- OAuth callback from PayPal
+		if (! isset($_GET['page']) || 'wp-ultimo-settings' !== $_GET['page']) {
+			return;
+		}
+
+		// Get parameters from PayPal
+		// phpcs:disable WordPress.Security.NonceVerification.Recommended -- OAuth callback from PayPal
+		$merchant_id         = isset($_GET['merchantIdInPayPal']) ? sanitize_text_field(wp_unslash($_GET['merchantIdInPayPal'])) : '';
+		$merchant_email      = isset($_GET['merchantId']) ? sanitize_email(wp_unslash($_GET['merchantId'])) : '';
+		$permissions_granted = isset($_GET['permissionsGranted']) && 'true' === $_GET['permissionsGranted'];
+		$tracking_id         = isset($_GET['tracking_id']) ? sanitize_text_field(wp_unslash($_GET['tracking_id'])) : '';
+		// phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+		// Verify tracking ID was created by us
+		$onboarding_data = get_site_transient('wu_paypal_onboarding_' . $tracking_id);
+
+		if (! $onboarding_data) {
+			wu_log_add('paypal', 'OAuth return with invalid tracking ID: ' . $tracking_id, LogLevel::WARNING);
+			$this->add_oauth_notice('error', __('Invalid onboarding session. Please try again.', 'ultimate-multisite'));
+
+			return;
+		}
+
+		// Update test mode to match the onboarding session
+		$this->test_mode = $onboarding_data['test_mode'];
+
+		// Check if permissions were granted
+		if (! $permissions_granted) {
+			wu_log_add('paypal', 'OAuth: Merchant did not grant permissions', LogLevel::WARNING);
+			$this->add_oauth_notice('warning', __('PayPal permissions were not granted. Please try again and approve the required permissions.', 'ultimate-multisite'));
+
+			return;
+		}
+
+		// Verify the merchant status via the proxy
+		$merchant_status = $this->verify_merchant_via_proxy($merchant_id, $tracking_id);
+
+		if (is_wp_error($merchant_status)) {
+			wu_log_add('paypal', 'Failed to verify merchant status: ' . $merchant_status->get_error_message(), LogLevel::ERROR);
+			$this->add_oauth_notice('error', __('Failed to verify your PayPal account status. Please try again.', 'ultimate-multisite'));
+
+			return;
+		}
+
+		// Store the merchant credentials
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+
+		wu_save_setting("paypal_rest_{$mode_prefix}_merchant_id", $merchant_id);
+		wu_save_setting("paypal_rest_{$mode_prefix}_merchant_email", $merchant_email);
+		wu_save_setting('paypal_rest_connected', true);
+		wu_save_setting('paypal_rest_connection_date', current_time('mysql'));
+		wu_save_setting('paypal_rest_connection_mode', $mode_prefix);
+
+		// Store additional status info if available
+		if (! empty($merchant_status['paymentsReceivable'])) {
+			wu_save_setting("paypal_rest_{$mode_prefix}_payments_receivable", $merchant_status['paymentsReceivable']);
+		}
+
+		if (! empty($merchant_status['emailConfirmed'])) {
+			wu_save_setting("paypal_rest_{$mode_prefix}_email_confirmed", $merchant_status['emailConfirmed']);
+		}
+
+		// Clean up the tracking transient
+		delete_site_transient('wu_paypal_onboarding_' . $tracking_id);
+
+		wu_log_add('paypal', sprintf('PayPal OAuth completed. Merchant ID: %s, Mode: %s', $merchant_id, $mode_prefix));
+
+		// Automatically install webhooks for the connected account
+		$this->install_webhook_after_oauth($mode_prefix);
+
+		$this->add_oauth_notice('success', __('PayPal account connected successfully!', 'ultimate-multisite'));
+
+		// Redirect to remove query parameters
+		wp_safe_redirect(
+			add_query_arg(
+				[
+					'page'             => 'wp-ultimo-settings',
+					'tab'              => 'payment-gateways',
+					'paypal_connected' => '1',
+				],
+				network_admin_url('admin.php')
+			)
+		);
+		exit;
+	}
+
+	/**
+	 * Verify merchant status via the proxy.
+	 *
+	 * The proxy holds the partner credentials needed to check the
+	 * merchant's integration status with PayPal.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $merchant_id The merchant's PayPal ID.
+	 * @param string $tracking_id The tracking ID from onboarding.
+	 * @return array|\WP_Error Merchant status data or error.
+	 */
+	protected function verify_merchant_via_proxy(string $merchant_id, string $tracking_id) {
+
+		$proxy_url = $this->get_proxy_url();
+
+		$response = wp_remote_post(
+			$proxy_url . '/oauth/verify',
+			[
+				'body'    => wp_json_encode(
+					[
+						'merchantId' => $merchant_id,
+						'trackingId' => $tracking_id,
+						'testMode'   => $this->test_mode,
+					]
+				),
+				'headers' => [
+					'Content-Type' => 'application/json',
+				],
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($response)) {
+			return $response;
+		}
+
+		$status_code = wp_remote_retrieve_response_code($response);
+		$data        = json_decode(wp_remote_retrieve_body($response), true);
+
+		if (200 !== $status_code) {
+			$error_msg = $data['error'] ?? __('Failed to verify merchant status', 'ultimate-multisite');
+
+			return new \WP_Error('wu_paypal_verify_error', $error_msg);
+		}
+
+		return $data;
+	}
+
+	/**
+	 * AJAX handler to disconnect PayPal.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function ajax_disconnect(): void {
+
+		check_ajax_referer('wu_paypal_oauth', 'nonce');
+
+		if (! current_user_can('manage_network_options')) {
+			wp_send_json_error(
+				[
+					'message' => __('You do not have permission to do this.', 'ultimate-multisite'),
+				]
+			);
+		}
+
+		// Delete webhooks before clearing credentials
+		$this->delete_webhooks_on_disconnect();
+
+		// Notify proxy of disconnect (non-blocking)
+		$proxy_url = $this->get_proxy_url();
+
+		wp_remote_post(
+			$proxy_url . '/deauthorize',
+			[
+				'body'     => wp_json_encode(
+					[
+						'siteUrl'  => get_site_url(),
+						'testMode' => $this->test_mode,
+					]
+				),
+				'headers'  => ['Content-Type' => 'application/json'],
+				'timeout'  => 10,
+				'blocking' => false,
+			]
+		);
+
+		// Clear all connection data
+		$settings_to_clear = [
+			'paypal_rest_connected',
+			'paypal_rest_connection_date',
+			'paypal_rest_connection_mode',
+			'paypal_rest_sandbox_merchant_id',
+			'paypal_rest_sandbox_merchant_email',
+			'paypal_rest_sandbox_payments_receivable',
+			'paypal_rest_sandbox_email_confirmed',
+			'paypal_rest_live_merchant_id',
+			'paypal_rest_live_merchant_email',
+			'paypal_rest_live_payments_receivable',
+			'paypal_rest_live_email_confirmed',
+			'paypal_rest_sandbox_webhook_id',
+			'paypal_rest_live_webhook_id',
+		];
+
+		foreach ($settings_to_clear as $setting) {
+			wu_save_setting($setting, '');
+		}
+
+		// Clear cached access tokens
+		delete_site_transient('wu_paypal_rest_access_token_sandbox');
+		delete_site_transient('wu_paypal_rest_access_token_live');
+
+		wu_log_add('paypal', 'PayPal account disconnected');
+
+		wp_send_json_success(
+			[
+				'message' => __('PayPal account disconnected successfully.', 'ultimate-multisite'),
+			]
+		);
+	}
+
+	/**
+	 * Add an admin notice for OAuth status.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $type    Notice type: 'success', 'error', 'warning', 'info'.
+	 * @param string $message The notice message.
+	 * @return void
+	 */
+	protected function add_oauth_notice(string $type, string $message): void {
+
+		set_site_transient(
+			'wu_paypal_oauth_notice',
+			[
+				'type'    => $type,
+				'message' => $message,
+			],
+			60
+		);
+	}
+
+	/**
+	 * Display OAuth notices.
+	 *
+	 * Should be called on admin_notices hook.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function display_oauth_notices(): void {
+
+		$notice = get_site_transient('wu_paypal_oauth_notice');
+
+		if ($notice) {
+			delete_site_transient('wu_paypal_oauth_notice');
+
+			$class = 'notice notice-' . esc_attr($notice['type']) . ' is-dismissible';
+			printf(
+				'<div class="%1$s"><p>%2$s</p></div>',
+				esc_attr($class),
+				esc_html($notice['message'])
+			);
+		}
+	}
+
+	/**
+	 * Check if the proxy is reachable and configured.
+	 *
+	 * This replaces the old is_configured() which checked for local partner credentials.
+	 * Now we just check if the proxy URL is set (it always is by default).
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function is_configured(): bool {
+
+		return ! empty($this->get_proxy_url());
+	}
+
+	/**
+	 * Check if the PayPal OAuth Connect feature is enabled.
+	 *
+	 * The feature flag is controlled by the PayPal proxy plugin on
+	 * ultimatemultisite.com. OAuth Connect is only available when the
+	 * proxy has partner credentials configured (i.e. the PayPal
+	 * partnership is active). The result is cached for 12 hours.
+	 *
+	 * Local override: define WU_PAYPAL_OAUTH_ENABLED as true in
+	 * wp-config.php to force-enable without the proxy check.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function is_oauth_feature_enabled(): bool {
+
+		// Local constant override (useful for dev/testing)
+		if (defined('WU_PAYPAL_OAUTH_ENABLED')) {
+			return (bool) WU_PAYPAL_OAUTH_ENABLED;
+		}
+
+		/**
+		 * Filters whether the PayPal OAuth Connect feature is enabled.
+		 *
+		 * Return a non-null value to override the remote check.
+		 *
+		 * @since 2.0.0
+		 *
+		 * @param bool|null $enabled Null to use remote check, bool to override.
+		 */
+		$override = apply_filters('wu_paypal_oauth_enabled', null);
+
+		if (null !== $override) {
+			return (bool) $override;
+		}
+
+		// Check cached flag from proxy
+		$cached = get_site_transient('wu_paypal_oauth_enabled');
+
+		if (false !== $cached) {
+			return 'yes' === $cached;
+		}
+
+		// Fetch from proxy /status endpoint
+		$proxy_url = $this->get_proxy_url();
+
+		if (empty($proxy_url)) {
+			return false;
+		}
+
+		$response = wp_remote_get(
+			$proxy_url . '/status',
+			['timeout' => 5]
+		);
+
+		if (is_wp_error($response)) {
+			// Cache failure as disabled for 1 hour (retry sooner)
+			set_site_transient('wu_paypal_oauth_enabled', 'no', HOUR_IN_SECONDS);
+
+			return false;
+		}
+
+		$body    = json_decode(wp_remote_retrieve_body($response), true);
+		$enabled = ! empty($body['oauth_enabled']);
+
+		set_site_transient(
+			'wu_paypal_oauth_enabled',
+			$enabled ? 'yes' : 'no',
+			12 * HOUR_IN_SECONDS
+		);
+
+		return $enabled;
+	}
+
+	/**
+	 * Check if a merchant is connected via OAuth.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param bool $sandbox Whether to check sandbox mode.
+	 * @return bool
+	 */
+	public function is_merchant_connected(bool $sandbox = true): bool {
+
+		$mode_prefix = $sandbox ? 'sandbox' : 'live';
+		$merchant_id = wu_get_setting("paypal_rest_{$mode_prefix}_merchant_id", '');
+
+		return ! empty($merchant_id);
+	}
+
+	/**
+	 * Get connected merchant details.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param bool $sandbox Whether to get sandbox mode details.
+	 * @return array
+	 */
+	public function get_merchant_details(bool $sandbox = true): array {
+
+		$mode_prefix = $sandbox ? 'sandbox' : 'live';
+
+		return [
+			'merchant_id'         => wu_get_setting("paypal_rest_{$mode_prefix}_merchant_id", ''),
+			'merchant_email'      => wu_get_setting("paypal_rest_{$mode_prefix}_merchant_email", ''),
+			'payments_receivable' => wu_get_setting("paypal_rest_{$mode_prefix}_payments_receivable", false),
+			'email_confirmed'     => wu_get_setting("paypal_rest_{$mode_prefix}_email_confirmed", false),
+			'connection_date'     => wu_get_setting('paypal_rest_connection_date', ''),
+		];
+	}
+
+	/**
+	 * Install webhooks after successful OAuth connection.
+	 *
+	 * Creates the webhook endpoint in PayPal to receive subscription and payment events.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $mode_prefix The mode prefix ('sandbox' or 'live').
+	 * @return void
+	 */
+	protected function install_webhook_after_oauth(string $mode_prefix): void {
+
+		try {
+			// Get the PayPal REST gateway instance
+			$gateway = wu_get_gateway('paypal-rest');
+
+			if (! $gateway instanceof PayPal_REST_Gateway) {
+				wu_log_add('paypal', 'Could not get PayPal REST gateway instance for webhook installation', LogLevel::WARNING);
+
+				return;
+			}
+
+			// Ensure the gateway is in the correct mode
+			$gateway->set_test_mode('sandbox' === $mode_prefix);
+
+			// Install the webhook
+			$result = $gateway->install_webhook();
+
+			if (true === $result) {
+				wu_log_add('paypal', sprintf('Webhook installed successfully for %s mode after OAuth', $mode_prefix));
+			} elseif (is_wp_error($result)) {
+				wu_log_add('paypal', sprintf('Failed to install webhook after OAuth: %s', $result->get_error_message()), LogLevel::ERROR);
+			}
+		} catch (\Exception $e) {
+			wu_log_add('paypal', sprintf('Exception installing webhook after OAuth: %s', $e->getMessage()), LogLevel::ERROR);
+		}
+	}
+
+	/**
+	 * Delete webhooks when disconnecting from PayPal.
+	 *
+	 * Attempts to delete webhooks from both sandbox and live modes.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	protected function delete_webhooks_on_disconnect(): void {
+
+		try {
+			$gateway = wu_get_gateway('paypal-rest');
+
+			if (! $gateway instanceof PayPal_REST_Gateway) {
+				return;
+			}
+
+			// Try to delete sandbox webhook
+			$gateway->set_test_mode(true);
+			$result = $gateway->delete_webhook();
+
+			if (is_wp_error($result)) {
+				wu_log_add('paypal', sprintf('Failed to delete sandbox webhook: %s', $result->get_error_message()), LogLevel::WARNING);
+			} else {
+				wu_log_add('paypal', 'Sandbox webhook deleted during disconnect');
+			}
+
+			// Try to delete live webhook
+			$gateway->set_test_mode(false);
+			$result = $gateway->delete_webhook();
+
+			if (is_wp_error($result)) {
+				wu_log_add('paypal', sprintf('Failed to delete live webhook: %s', $result->get_error_message()), LogLevel::WARNING);
+			} else {
+				wu_log_add('paypal', 'Live webhook deleted during disconnect');
+			}
+		} catch (\Exception $e) {
+			wu_log_add('paypal', sprintf('Exception deleting webhooks during disconnect: %s', $e->getMessage()), LogLevel::WARNING);
+		}
+	}
+}
diff --git a/inc/gateways/class-paypal-rest-gateway.php b/inc/gateways/class-paypal-rest-gateway.php
new file mode 100644
index 000000000..9f80355fc
--- /dev/null
+++ b/inc/gateways/class-paypal-rest-gateway.php
@@ -0,0 +1,2034 @@
+<?php
+/**
+ * PayPal REST Gateway.
+ *
+ * Modern PayPal integration using the REST API with OAuth authentication.
+ * Supports PayPal Commerce Platform (PPCP) with "Connect with PayPal" onboarding.
+ *
+ * @package WP_Ultimo
+ * @subpackage Gateways
+ * @since 2.0.0
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use Psr\Log\LogLevel;
+use WP_Ultimo\Gateways\Base_PayPal_Gateway;
+use WP_Ultimo\Gateways\PayPal_OAuth_Handler;
+use WP_Ultimo\Database\Payments\Payment_Status;
+use WP_Ultimo\Database\Memberships\Membership_Status;
+
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+/**
+ * PayPal REST API Gateway
+ *
+ * @since 2.0.0
+ */
+class PayPal_REST_Gateway extends Base_PayPal_Gateway {
+
+	/**
+	 * Holds the ID of this gateway.
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $id = 'paypal-rest';
+
+	/**
+	 * Backwards compatibility for the old notify ajax url.
+	 *
+	 * @since 2.0.0
+	 * @var bool|string
+	 */
+	protected $backwards_compatibility_v1_id = false;
+
+	/**
+	 * Client ID for REST API authentication.
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $client_id = '';
+
+	/**
+	 * Client secret for REST API authentication.
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $client_secret = '';
+
+	/**
+	 * Merchant ID from OAuth onboarding.
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $merchant_id = '';
+
+	/**
+	 * Cached access token.
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $access_token = '';
+
+	/**
+	 * Partner client ID (set when using OAuth/proxy mode).
+	 *
+	 * @since 2.0.0
+	 * @var string
+	 */
+	protected $partner_client_id = '';
+
+	/**
+	 * Currencies supported by the PayPal REST API.
+	 *
+	 * @since 2.0.0
+	 * @link https://developer.paypal.com/docs/reports/reference/paypal-supported-currencies/
+	 */
+	protected const SUPPORTED_CURRENCIES = [
+		'AUD',
+		'BRL',
+		'CAD',
+		'CNY',
+		'CZK',
+		'DKK',
+		'EUR',
+		'HKD',
+		'HUF',
+		'ILS',
+		'JPY',
+		'MYR',
+		'MXN',
+		'TWD',
+		'NZD',
+		'NOK',
+		'PHP',
+		'PLN',
+		'GBP',
+		'SGD',
+		'SEK',
+		'CHF',
+		'THB',
+		'USD',
+	];
+
+	/**
+	 * Initialization code.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function init(): void {
+
+		$this->test_mode = (bool) (int) wu_get_setting('paypal_rest_sandbox_mode', true);
+
+		$this->load_credentials();
+	}
+
+	/**
+	 * Load credentials from settings.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	protected function load_credentials(): void {
+
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+
+		// First check for OAuth-connected merchant
+		$this->merchant_id = wu_get_setting("paypal_rest_{$mode_prefix}_merchant_id", '');
+
+		// Load client credentials (either from OAuth or manual entry)
+		$this->client_id     = wu_get_setting("paypal_rest_{$mode_prefix}_client_id", '');
+		$this->client_secret = wu_get_setting("paypal_rest_{$mode_prefix}_client_secret", '');
+	}
+
+	/**
+	 * Set the test mode and reload credentials.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param bool $test_mode Whether to use sandbox mode.
+	 * @return void
+	 */
+	public function set_test_mode(bool $test_mode): void {
+
+		$this->test_mode         = $test_mode;
+		$this->access_token      = ''; // Clear cached token
+		$this->partner_client_id = '';
+
+		$this->load_credentials();
+	}
+
+	/**
+	 * Adds the necessary hooks for the REST PayPal gateway.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function hooks(): void {
+
+		parent::hooks();
+
+		// Initialize OAuth handler
+		PayPal_OAuth_Handler::get_instance()->init();
+
+		// Handle webhook installation after settings save
+		add_action('wu_after_save_settings', [$this, 'maybe_install_webhook'], 10, 3);
+
+		// AJAX handler for manual webhook installation
+		add_action('wp_ajax_wu_paypal_install_webhook', [$this, 'ajax_install_webhook']);
+
+		// Display OAuth notices
+		add_action('admin_notices', [PayPal_OAuth_Handler::get_instance(), 'display_oauth_notices']);
+
+		// Hide PayPal from checkout when currency is not supported
+		add_filter('wu_get_active_gateways', [$this, 'maybe_remove_for_unsupported_currency']);
+
+		// Register PayPal checkout scripts (button branding)
+		add_action('wu_checkout_scripts', [$this, 'register_scripts']);
+
+		// Display PayPal logo with equal prominence on checkout
+		add_filter('wu_gateway_paypal-rest_as_option_title', [$this, 'get_checkout_label_html']);
+	}
+
+	/**
+	 * Checks if PayPal REST is properly configured.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function is_configured(): bool {
+
+		// Either OAuth connected OR manual credentials
+		$has_oauth  = ! empty($this->merchant_id);
+		$has_manual = ! empty($this->client_id) && ! empty($this->client_secret);
+
+		return $has_oauth || $has_manual;
+	}
+
+	/**
+	 * Checks if the current store currency is supported by PayPal.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public static function is_currency_supported(): bool {
+
+		$currency = strtoupper((string) wu_get_setting('currency', 'USD'));
+
+		return in_array($currency, self::SUPPORTED_CURRENCIES, true);
+	}
+
+	/**
+	 * Removes PayPal from the active gateways list when the store currency is not supported.
+	 *
+	 * Hooked to 'wu_get_active_gateways'.
+	 *
+	 * @since 2.0.0
+	 * @param array $gateways The registered active gateways.
+	 * @return array
+	 */
+	public function maybe_remove_for_unsupported_currency(array $gateways): array {
+
+		if (! self::is_currency_supported()) {
+			unset($gateways['paypal-rest']);
+		}
+
+		return $gateways;
+	}
+
+	/**
+	 * Returns a branded HTML label for the PayPal option in the checkout gateway selector.
+	 *
+	 * Hooked to 'wu_gateway_paypal-rest_as_option_title'.
+	 *
+	 * @since 2.0.0
+	 * @param string $title The default title string.
+	 * @return string HTML label with the PayPal logo.
+	 */
+	public function get_checkout_label_html(string $title): string {
+
+		return sprintf(
+			'<span class="wu-inline-flex wu-items-center" style="gap:6px"><img src="%s" alt="" aria-hidden="true" height="20" style="vertical-align:middle;max-height:20px" loading="lazy"><span>%s</span></span>',
+			esc_url('https://www.paypalobjects.com/webstatic/mktg/Logo/pp-logo-100px.png'),
+			esc_html__('PayPal', 'ultimate-multisite')
+		);
+	}
+
+	/**
+	 * Returns the connection status for display in settings.
+	 *
+	 * @since 2.0.0
+	 * @return array{connected: bool, message: string, details: array}
+	 */
+	public function get_connection_status(): array {
+
+		$oauth_handler = PayPal_OAuth_Handler::get_instance();
+		$is_sandbox    = $this->test_mode;
+
+		if ($oauth_handler->is_merchant_connected($is_sandbox)) {
+			$merchant_details = $oauth_handler->get_merchant_details($is_sandbox);
+
+			return [
+				'connected' => true,
+				'message'   => __('Connected via PayPal', 'ultimate-multisite'),
+				'details'   => [
+					'mode'         => $is_sandbox ? 'sandbox' : 'live',
+					'merchant_id'  => $merchant_details['merchant_id'],
+					'email'        => $merchant_details['merchant_email'],
+					'connected_at' => $merchant_details['connection_date'],
+					'method'       => 'oauth',
+				],
+			];
+		}
+
+		if (! empty($this->client_id) && ! empty($this->client_secret)) {
+			return [
+				'connected' => true,
+				'message'   => __('Connected via API credentials', 'ultimate-multisite'),
+				'details'   => [
+					'mode'      => $is_sandbox ? 'sandbox' : 'live',
+					'client_id' => substr($this->client_id, 0, 20) . '...',
+					'method'    => 'manual',
+				],
+			];
+		}
+
+		return [
+			'connected' => false,
+			'message'   => __('Not connected', 'ultimate-multisite'),
+			'details'   => [
+				'mode' => $is_sandbox ? 'sandbox' : 'live',
+			],
+		];
+	}
+
+	/**
+	 * Whether to apply platform fees to payments.
+	 *
+	 * Platform fees only apply when the merchant connected via OAuth
+	 * (Partner Referral flow) and has not purchased any addon.
+	 * Manual credential users are not charged platform fees.
+	 *
+	 * @since 2.0.0
+	 * @return bool
+	 */
+	public function should_apply_platform_fee(): bool {
+
+		if (empty($this->merchant_id)) {
+			return false;
+		}
+
+		$addon_repo = \WP_Ultimo::get_instance()->get_addon_repository();
+
+		return ! $addon_repo->has_addon_purchase();
+	}
+
+	/**
+	 * Gets the platform fee percentage.
+	 *
+	 * @since 2.0.0
+	 * @return float
+	 */
+	public function get_platform_fee_percent(): float {
+
+		return 3.0;
+	}
+
+	/**
+	 * Get partner data (access token and client ID) from the proxy.
+	 *
+	 * Cached in a transient to avoid calling the proxy on every payment.
+	 *
+	 * @since 2.0.0
+	 * @return array{access_token: string, partner_client_id: string}|\WP_Error
+	 */
+	protected function get_partner_data() {
+
+		$cache_key = 'wu_paypal_partner_data_' . ($this->test_mode ? 'sandbox' : 'live');
+		$cached    = get_site_transient($cache_key);
+
+		if ($cached && ! empty($cached['access_token'])) {
+			return $cached;
+		}
+
+		$proxy_url = apply_filters('wu_paypal_connect_proxy_url', 'https://ultimatemultisite.com/wp-json/paypal-connect/v1');
+
+		$response = wp_remote_post(
+			$proxy_url . '/partner-token',
+			[
+				'body'    => wp_json_encode(['testMode' => $this->test_mode]),
+				'headers' => ['Content-Type' => 'application/json'],
+				'timeout' => 15,
+			]
+		);
+
+		if (is_wp_error($response)) {
+			return $response;
+		}
+
+		$body = json_decode(wp_remote_retrieve_body($response), true);
+		$code = wp_remote_retrieve_response_code($response);
+
+		if (200 !== $code || empty($body['access_token'])) {
+			return new \WP_Error(
+				'wu_paypal_partner_token_error',
+				$body['error'] ?? __('Failed to get partner token from proxy.', 'ultimate-multisite')
+			);
+		}
+
+		$data = [
+			'access_token'      => $body['access_token'],
+			'partner_client_id' => $body['partner_client_id'] ?? '',
+		];
+
+		$expires_in = (int) ($body['expires_in'] ?? 3300);
+		set_site_transient($cache_key, $data, $expires_in);
+
+		return $data;
+	}
+
+	/**
+	 * Build PayPal-Auth-Assertion JWT header.
+	 *
+	 * Used to make API calls on behalf of a merchant using the partner's token.
+	 *
+	 * @see https://developer.paypal.com/docs/api/reference/api-requests/#paypal-auth-assertion
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $partner_client_id The partner's PayPal client ID.
+	 * @param string $merchant_payer_id The merchant's PayPal payer/merchant ID.
+	 * @return string The JWT assertion string.
+	 */
+	protected function build_auth_assertion(string $partner_client_id, string $merchant_payer_id): string {
+
+		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for PayPal Auth Assertion JWT
+		$header = base64_encode(wp_json_encode(['alg' => 'none']));
+
+		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for PayPal Auth Assertion JWT
+		$payload = base64_encode(
+			wp_json_encode(
+				[
+					'iss'      => $partner_client_id,
+					'payer_id' => $merchant_payer_id,
+				]
+			)
+		);
+
+		return $header . '.' . $payload . '.';
+	}
+
+	/**
+	 * Create a PayPal order with platform fees via partner credentials.
+	 *
+	 * Uses the partner's access token and PayPal-Auth-Assertion header
+	 * to create an order on behalf of the merchant with a platform fee.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array  $order_data The order data (without platform fee).
+	 * @param string $currency The currency code.
+	 * @param float  $total The total amount.
+	 * @return array|\WP_Error The PayPal API response or error.
+	 */
+	protected function create_order_with_platform_fee(array $order_data, string $currency, float $total) {
+
+		$partner_data = $this->get_partner_data();
+
+		if (is_wp_error($partner_data)) {
+			$this->log('Platform fee skipped: ' . $partner_data->get_error_message());
+
+			return $partner_data;
+		}
+
+		if (empty($partner_data['partner_client_id'])) {
+			return new \WP_Error('wu_paypal_no_partner_id', 'Partner client ID not available.');
+		}
+
+		// Calculate the platform fee
+		$fee_amount = round($total * $this->get_platform_fee_percent() / 100, 2);
+
+		if ($fee_amount < 0.01) {
+			return new \WP_Error('wu_paypal_fee_too_small', 'Platform fee amount too small.');
+		}
+
+		// Add platform fee to the first purchase unit
+		$order_data['purchase_units'][0]['payment_instruction'] = [
+			'platform_fees' => [
+				[
+					'amount' => [
+						'currency_code' => $currency,
+						'value'         => number_format($fee_amount, 2, '.', ''),
+					],
+				],
+			],
+		];
+
+		// Build the auth assertion
+		$auth_assertion = $this->build_auth_assertion(
+			$partner_data['partner_client_id'],
+			$this->merchant_id
+		);
+
+		// Make the API call with partner credentials
+		$response = wp_remote_post(
+			$this->get_api_base_url() . '/v2/checkout/orders',
+			[
+				'headers' => [
+					'Authorization'                 => 'Bearer ' . $partner_data['access_token'],
+					'Content-Type'                  => 'application/json',
+					'PayPal-Auth-Assertion'         => $auth_assertion,
+					'PayPal-Partner-Attribution-Id' => $this->bn_code,
+				],
+				'body'    => wp_json_encode($order_data),
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($response)) {
+			return $response;
+		}
+
+		$body = json_decode(wp_remote_retrieve_body($response), true);
+		$code = wp_remote_retrieve_response_code($response);
+
+		if ($code < 200 || $code >= 300) {
+			$error_msg = $body['message'] ?? __('PayPal API error', 'ultimate-multisite');
+
+			return new \WP_Error('wu_paypal_order_error', $error_msg);
+		}
+
+		$this->log(sprintf('Order created with %.2f%% platform fee ($%s)', $this->get_platform_fee_percent(), number_format($fee_amount, 2)));
+
+		return $body;
+	}
+
+	/**
+	 * Get an access token for API requests.
+	 *
+	 * @since 2.0.0
+	 * @return string|\WP_Error Access token or error.
+	 */
+	protected function get_access_token() {
+
+		if (! empty($this->access_token)) {
+			return $this->access_token;
+		}
+
+		$mode_suffix = $this->test_mode ? 'sandbox' : 'live';
+
+		// OAuth mode: use partner token from proxy (cached as array to preserve partner_client_id)
+		if (! empty($this->merchant_id) && (empty($this->client_id) || empty($this->client_secret))) {
+			$oauth_cache_key = 'wu_paypal_rest_partner_data_' . $mode_suffix;
+			$cached_partner  = get_site_transient($oauth_cache_key);
+
+			if ($cached_partner && ! empty($cached_partner['access_token'])) {
+				$this->partner_client_id = $cached_partner['partner_client_id'];
+				$this->access_token      = $cached_partner['access_token'];
+
+				return $this->access_token;
+			}
+
+			$partner_data = $this->get_partner_data();
+
+			if (is_wp_error($partner_data)) {
+				return $partner_data;
+			}
+
+			$this->partner_client_id = $partner_data['partner_client_id'];
+			$this->access_token      = $partner_data['access_token'];
+
+			set_site_transient($oauth_cache_key, $partner_data, 3300);
+
+			return $this->access_token;
+		}
+
+		// Manual credentials mode
+		$cache_key    = 'wu_paypal_rest_access_token_' . $mode_suffix;
+		$cached_token = get_site_transient($cache_key);
+
+		if ($cached_token) {
+			$this->access_token = $cached_token;
+			return $this->access_token;
+		}
+
+		if (empty($this->client_id) || empty($this->client_secret)) {
+			return new \WP_Error(
+				'wu_paypal_missing_credentials',
+				__('PayPal API credentials not configured.', 'ultimate-multisite')
+			);
+		}
+
+		$response = wp_remote_post(
+			$this->get_api_base_url() . '/v1/oauth2/token',
+			[
+				'headers' => [
+					'Authorization' => 'Basic ' . base64_encode($this->client_id . ':' . $this->client_secret), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for PayPal API Basic auth
+					'Content-Type'  => 'application/x-www-form-urlencoded',
+				],
+				'body'    => 'grant_type=client_credentials',
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($response)) {
+			$this->log('Failed to get access token: ' . $response->get_error_message(), LogLevel::ERROR);
+			return $response;
+		}
+
+		$body = json_decode(wp_remote_retrieve_body($response), true);
+		$code = wp_remote_retrieve_response_code($response);
+
+		if (200 !== $code || empty($body['access_token'])) {
+			$error_msg = $body['error_description'] ?? __('Failed to obtain access token', 'ultimate-multisite');
+			$this->log('Failed to get access token: ' . $error_msg, LogLevel::ERROR);
+			return new \WP_Error('wu_paypal_token_error', $error_msg);
+		}
+
+		// Cache the token (expires_in is in seconds, subtract 5 minutes for safety)
+		$expires_in = isset($body['expires_in']) ? (int) $body['expires_in'] - 300 : 3300;
+		set_site_transient($cache_key, $body['access_token'], $expires_in);
+
+		$this->access_token = $body['access_token'];
+
+		return $this->access_token;
+	}
+
+	/**
+	 * Make an API request to PayPal REST API.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $endpoint      API endpoint (relative to base URL).
+	 * @param array  $data          Request data.
+	 * @param string $method        HTTP method.
+	 * @param array  $extra_headers Additional HTTP headers to include.
+	 * @return array|\WP_Error Response data or error.
+	 */
+	protected function api_request(string $endpoint, array $data = [], string $method = 'POST', array $extra_headers = []) {
+
+		$access_token = $this->get_access_token();
+
+		if (is_wp_error($access_token)) {
+			return $access_token;
+		}
+
+		$headers = [
+			'Authorization' => 'Bearer ' . $access_token,
+			'Content-Type'  => 'application/json',
+		];
+
+		$headers = $this->add_partner_attribution_header($headers);
+
+		// In OAuth mode, add PayPal-Auth-Assertion so calls act on behalf of the connected merchant
+		if (! empty($this->merchant_id) && ! empty($this->partner_client_id)) {
+			$headers['PayPal-Auth-Assertion'] = $this->build_auth_assertion($this->partner_client_id, $this->merchant_id);
+		}
+
+		$headers = array_merge($headers, $extra_headers);
+
+		$args = [
+			'headers' => $headers,
+			'method'  => $method,
+			'timeout' => 45,
+		];
+
+		if (! empty($data) && in_array($method, ['POST', 'PATCH', 'PUT'], true)) {
+			$args['body'] = wp_json_encode($data);
+		}
+
+		$url = $this->get_api_base_url() . $endpoint;
+
+		$this->log(sprintf('API Request: %s %s', $method, $endpoint));
+
+		$response = wp_remote_request($url, $args);
+
+		if (is_wp_error($response)) {
+			$this->log('API Request failed: ' . $response->get_error_message(), LogLevel::ERROR);
+			return $response;
+		}
+
+		$body = json_decode(wp_remote_retrieve_body($response), true);
+		$code = wp_remote_retrieve_response_code($response);
+
+		if ($code >= 400) {
+			$error_msg = $body['message'] ?? ($body['error_description'] ?? __('API request failed', 'ultimate-multisite'));
+			$this->log(sprintf('API Error (%d): %s', $code, wp_json_encode($body)), LogLevel::ERROR);
+			return new \WP_Error(
+				'wu_paypal_api_error',
+				$error_msg,
+				[
+					'status'   => $code,
+					'response' => $body,
+				]
+			);
+		}
+
+		return $body ?? [];
+	}
+
+	/**
+	 * Process a checkout.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Payment    $payment    The payment associated with the checkout.
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer checking out.
+	 * @param \WP_Ultimo\Checkout\Cart     $cart       The cart object.
+	 * @param string                       $type       The checkout type.
+	 * @return void
+	 */
+	public function process_checkout($payment, $membership, $customer, $cart, $type): void {
+
+		$should_auto_renew = $cart->should_auto_renew();
+		$is_recurring      = $cart->has_recurring();
+
+		if ($should_auto_renew && $is_recurring) {
+			$this->create_subscription($payment, $membership, $customer, $cart, $type);
+		} else {
+			$this->create_order($payment, $membership, $customer, $cart, $type);
+		}
+	}
+
+	/**
+	 * Create a PayPal subscription for recurring payments.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Payment    $payment    The payment.
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer.
+	 * @param \WP_Ultimo\Checkout\Cart     $cart       The cart object.
+	 * @param string                       $type       The checkout type.
+	 * @return void
+	 */
+	protected function create_subscription($payment, $membership, $customer, $cart, $type): void {
+
+		$currency    = $this->get_payment_currency_code($payment);
+		$description = $this->get_subscription_description($cart);
+
+		// First, create or get the billing plan
+		$plan_id = $this->get_or_create_plan($cart, $currency);
+
+		if (is_wp_error($plan_id)) {
+			wp_die(
+				esc_html($plan_id->get_error_message()),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				[
+					'back_link' => true,
+					'response'  => '200',
+				]
+			);
+		}
+
+		// Create the subscription
+		$subscription_data = [
+			'plan_id'             => $plan_id,
+			'subscriber'          => [
+				'name'          => [
+					'given_name' => $customer->get_display_name(),
+				],
+				'email_address' => $customer->get_email_address(),
+			],
+			'application_context' => [
+				'brand_name'          => wu_get_setting('company_name', get_network_option(null, 'site_name')),
+				'locale'              => str_replace('_', '-', get_locale()),
+				'shipping_preference' => 'NO_SHIPPING',
+				'user_action'         => 'SUBSCRIBE_NOW',
+				'return_url'          => $this->get_confirm_url(),
+				'cancel_url'          => $this->get_cancel_url(),
+			],
+			'custom_id'           => sprintf('%s|%s|%s', $payment->get_id(), $membership->get_id(), $customer->get_id()),
+		];
+
+		// Handle initial payment if different from recurring
+		$initial_amount   = $payment->get_total();
+		$recurring_amount = $cart->get_recurring_total();
+
+		if ($initial_amount > 0 && abs($initial_amount - $recurring_amount) > 0.01) {
+			// Add setup fee for the difference
+			$setup_fee = $initial_amount - $recurring_amount;
+			if ($setup_fee > 0) {
+				$subscription_data['plan'] = [
+					'payment_preferences' => [
+						'setup_fee' => [
+							'value'         => number_format($setup_fee, 2, '.', ''),
+							'currency_code' => $currency,
+						],
+					],
+				];
+			}
+		}
+
+		// Handle trial periods
+		if ($membership->is_trialing()) {
+			$trial_end = $membership->get_date_trial_end();
+			if ($trial_end) {
+				$subscription_data['start_time'] = gmdate('Y-m-d\TH:i:s\Z', strtotime($trial_end));
+			}
+		}
+
+		/**
+		 * Filter subscription data before creating.
+		 *
+		 * @since 2.0.0
+		 *
+		 * @param array $subscription_data The subscription data.
+		 * @param \WP_Ultimo\Models\Membership $membership The membership.
+		 * @param \WP_Ultimo\Checkout\Cart $cart The cart.
+		 */
+		$subscription_data = apply_filters('wu_paypal_rest_subscription_data', $subscription_data, $membership, $cart);
+
+		$result = $this->api_request('/v1/billing/subscriptions', $subscription_data);
+
+		if (is_wp_error($result)) {
+			wp_die(
+				esc_html($result->get_error_message()),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				[
+					'back_link' => true,
+					'response'  => '200',
+				]
+			);
+		}
+
+		// Find approval URL (PayPal returns 'approve' or 'payer-action' depending on context)
+		$approval_url = '';
+		foreach ($result['links'] ?? [] as $link) {
+			if (in_array($link['rel'], ['approve', 'payer-action'], true)) {
+				$approval_url = $link['href'];
+				break;
+			}
+		}
+
+		if (empty($approval_url)) {
+			wp_die(
+				esc_html__('Failed to get PayPal approval URL', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				[
+					'back_link' => true,
+					'response'  => '200',
+				]
+			);
+		}
+
+		// Store subscription ID for confirmation
+		$membership->set_gateway_subscription_id($result['id']);
+		$membership->save();
+
+		$this->log(sprintf('Subscription created: %s. Redirecting to approval.', $result['id']));
+
+		// Redirect to PayPal for approval
+		wp_redirect($approval_url); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- PayPal external URL
+		exit;
+	}
+
+	/**
+	 * Get the ISO 4217 currency code from a payment object.
+	 *
+	 * Some legacy payments store the currency symbol (e.g. "$") instead of
+	 * the ISO code. Normalise it by falling back to the store setting.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Payment $payment The payment object.
+	 * @return string 3-letter uppercase ISO currency code.
+	 */
+	protected function get_payment_currency_code($payment): string {
+
+		$currency = strtoupper($payment->get_currency());
+
+		// Validate it looks like an ISO 4217 code (3 uppercase ASCII letters).
+		if (preg_match('/^[A-Z]{3}$/', $currency)) {
+			return $currency;
+		}
+
+		// The stored value might be a symbol (e.g. "$") rather than a code.
+		// Look up the store currency setting — wu_get_currencies() is keyed by ISO code.
+		$store_currency = strtoupper(wu_get_setting('currency_symbol', 'USD'));
+
+		if (preg_match('/^[A-Z]{3}$/', $store_currency) && array_key_exists($store_currency, wu_get_currencies())) {
+			return $store_currency;
+		}
+
+		// Absolute fallback: find the first supported currency in the store currencies list.
+		foreach (array_keys(wu_get_currencies()) as $iso) {
+			if (in_array($iso, self::SUPPORTED_CURRENCIES, true)) {
+				return $iso;
+			}
+		}
+
+		return 'USD';
+	}
+
+	/**
+	 * Get or create a billing plan for the subscription.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Checkout\Cart $cart     The cart object.
+	 * @param string                   $currency The currency code.
+	 * @return string|\WP_Error Plan ID or error.
+	 */
+	protected function get_or_create_plan($cart, string $currency) {
+
+		// Generate a unique plan key based on cart contents
+		$plan_key = 'wu_paypal_plan_' . md5(
+			wp_json_encode(
+				[
+					'amount'        => $cart->get_recurring_total(),
+					'currency'      => $currency,
+					'duration'      => $cart->get_duration(),
+					'duration_unit' => $cart->get_duration_unit(),
+				]
+			)
+		);
+
+		// Check if we already have this plan
+		$existing_plan_id = get_site_option($plan_key);
+		if ($existing_plan_id) {
+			// Verify the plan still exists
+			$plan = $this->api_request('/v1/billing/plans/' . $existing_plan_id, [], 'GET');
+			if (! is_wp_error($plan) && isset($plan['id'])) {
+				return $plan['id'];
+			}
+		}
+
+		// First create a product
+		$product_name = wu_get_setting('company_name', get_network_option(null, 'site_name')) . ' - ' . $cart->get_cart_descriptor();
+
+		$product_data = [
+			'name'        => substr($product_name, 0, 127),
+			'description' => substr($this->get_subscription_description($cart), 0, 256),
+			'type'        => 'SERVICE',
+			'category'    => 'SOFTWARE',
+		];
+
+		$product = $this->api_request('/v1/catalogs/products', $product_data);
+
+		if (is_wp_error($product)) {
+			return $product;
+		}
+
+		// Convert duration unit to PayPal format
+		$interval_unit   = strtoupper($cart->get_duration_unit());
+		$interval_map    = [
+			'DAY'   => 'DAY',
+			'WEEK'  => 'WEEK',
+			'MONTH' => 'MONTH',
+			'YEAR'  => 'YEAR',
+		];
+		$paypal_interval = $interval_map[ $interval_unit ] ?? 'MONTH';
+
+		// Create the billing plan
+		$plan_data = [
+			'product_id'          => $product['id'],
+			'name'                => substr($product_name, 0, 127),
+			'description'         => substr($this->get_subscription_description($cart), 0, 127),
+			'billing_cycles'      => [
+				[
+					'frequency'      => [
+						'interval_unit'  => $paypal_interval,
+						'interval_count' => $cart->get_duration(),
+					],
+					'tenure_type'    => 'REGULAR',
+					'sequence'       => 1,
+					'total_cycles'   => 0, // 0 = unlimited
+					'pricing_scheme' => [
+						'fixed_price' => [
+							'value'         => number_format($cart->get_recurring_total(), 2, '.', ''),
+							'currency_code' => $currency,
+						],
+					],
+				],
+			],
+			'payment_preferences' => [
+				'auto_bill_outstanding'     => true,
+				'payment_failure_threshold' => 3,
+			],
+		];
+
+		$plan = $this->api_request('/v1/billing/plans', $plan_data);
+
+		if (is_wp_error($plan)) {
+			return $plan;
+		}
+
+		// Cache the plan ID
+		update_site_option($plan_key, $plan['id']);
+
+		$this->log(sprintf('Billing plan created: %s', $plan['id']));
+
+		return $plan['id'];
+	}
+
+	/**
+	 * Create a PayPal order for one-time payments.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Payment    $payment    The payment.
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer.
+	 * @param \WP_Ultimo\Checkout\Cart     $cart       The cart object.
+	 * @param string                       $type       The checkout type.
+	 * @return void
+	 */
+	protected function create_order($payment, $membership, $customer, $cart, $type): void {
+
+		$currency    = $this->get_payment_currency_code($payment);
+		$description = $this->get_subscription_description($cart);
+
+		$order_data = [
+			'intent'         => 'CAPTURE',
+			'payment_source' => [
+				'paypal' => [
+					'experience_context' => [
+						'brand_name'          => wu_get_setting('company_name', get_network_option(null, 'site_name')),
+						'locale'              => str_replace('_', '-', get_locale()),
+						'shipping_preference' => 'NO_SHIPPING',
+						'user_action'         => 'PAY_NOW',
+						'return_url'          => $this->get_confirm_url(),
+						'cancel_url'          => $this->get_cancel_url(),
+					],
+					'email_address'      => $customer->get_email_address(),
+				],
+			],
+			'purchase_units' => [
+				[
+					'reference_id' => $payment->get_hash(),
+					'description'  => substr($description, 0, 127),
+					'custom_id'    => sprintf('%s|%s|%s', $payment->get_id(), $membership->get_id(), $customer->get_id()),
+					'amount'       => [
+						'currency_code' => $currency,
+						'value'         => number_format($payment->get_total(), 2, '.', ''),
+						'breakdown'     => [
+							'item_total' => [
+								'currency_code' => $currency,
+								'value'         => number_format($payment->get_subtotal(), 2, '.', ''),
+							],
+							'tax_total'  => [
+								'currency_code' => $currency,
+								'value'         => number_format($payment->get_tax_total(), 2, '.', ''),
+							],
+						],
+					],
+					'items'        => $this->build_order_items($cart, $currency),
+				],
+			],
+		];
+
+		/**
+		 * Filter order data before creating.
+		 *
+		 * @since 2.0.0
+		 *
+		 * @param array $order_data The order data.
+		 * @param \WP_Ultimo\Models\Payment $payment The payment.
+		 * @param \WP_Ultimo\Checkout\Cart $cart The cart.
+		 */
+		$order_data = apply_filters('wu_paypal_rest_order_data', $order_data, $payment, $cart);
+
+		$result = null;
+
+		// Try creating with platform fee if applicable
+		if ($this->should_apply_platform_fee()) {
+			$result = $this->create_order_with_platform_fee($order_data, $currency, (float) $payment->get_total());
+
+			if (is_wp_error($result)) {
+				$this->log('Platform fee order failed, falling back to standard: ' . $result->get_error_message());
+				$result = null;
+			}
+		}
+
+		// Standard order creation (no platform fee or fallback)
+		if (null === $result) {
+			$result = $this->api_request('/v2/checkout/orders', $order_data);
+		}
+
+		if (is_wp_error($result)) {
+			wp_die(
+				esc_html($result->get_error_message()),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				[
+					'back_link' => true,
+					'response'  => '200',
+				]
+			);
+		}
+
+		// Find approval URL (PayPal returns 'approve' or 'payer-action' depending on context)
+		$approval_url = '';
+		foreach ($result['links'] ?? [] as $link) {
+			if (in_array($link['rel'], ['approve', 'payer-action'], true)) {
+				$approval_url = $link['href'];
+				break;
+			}
+		}
+
+		if (empty($approval_url)) {
+			wp_die(
+				esc_html__('Failed to get PayPal approval URL', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				[
+					'back_link' => true,
+					'response'  => '200',
+				]
+			);
+		}
+
+		// Store order ID for confirmation
+		$payment->set_gateway_payment_id($result['id']);
+		$payment->save();
+
+		$this->log(sprintf('Order created: %s. Redirecting to approval.', $result['id']));
+
+		// Redirect to PayPal for approval
+		wp_redirect($approval_url); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- PayPal external URL
+		exit;
+	}
+
+	/**
+	 * Build order items array for PayPal.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Checkout\Cart $cart     The cart object.
+	 * @param string                   $currency The currency code.
+	 * @return array
+	 */
+	protected function build_order_items($cart, string $currency): array {
+
+		$items = [];
+
+		foreach ($cart->get_line_items() as $line_item) {
+			$items[] = [
+				'name'        => substr($line_item->get_title(), 0, 127),
+				'description' => substr($line_item->get_description(), 0, 127) ?: null,
+				'unit_amount' => [
+					'currency_code' => $currency,
+					'value'         => number_format($line_item->get_unit_price(), 2, '.', ''),
+				],
+				'quantity'    => (string) $line_item->get_quantity(),
+				'category'    => 'DIGITAL_GOODS',
+			];
+		}
+
+		return $items;
+	}
+
+	/**
+	 * Process confirmation after PayPal approval.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function process_confirmation(): void {
+
+		$token           = sanitize_text_field(wu_request('token', ''));
+		$subscription_id = sanitize_text_field(wu_request('subscription_id', ''));
+
+		if (! empty($subscription_id)) {
+			$this->confirm_subscription($subscription_id);
+		} elseif (! empty($token)) {
+			$this->confirm_order($token);
+		} else {
+			wp_die(
+				esc_html__('Invalid PayPal confirmation', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+	}
+
+	/**
+	 * Confirm a subscription after PayPal approval.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $subscription_id The PayPal subscription ID.
+	 * @return void
+	 */
+	protected function confirm_subscription(string $subscription_id): void {
+
+		// Get subscription details
+		$subscription = $this->api_request('/v1/billing/subscriptions/' . $subscription_id, [], 'GET');
+
+		if (is_wp_error($subscription)) {
+			wp_die(
+				esc_html($subscription->get_error_message()),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		// Parse custom_id to get our IDs
+		$custom_parts = explode('|', $subscription['custom_id'] ?? '');
+		if (count($custom_parts) !== 3) {
+			wp_die(
+				esc_html__('Invalid subscription data', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		[$payment_id, $membership_id, $customer_id] = $custom_parts;
+
+		$payment    = wu_get_payment($payment_id);
+		$membership = wu_get_membership($membership_id);
+
+		if (! $payment || ! $membership) {
+			wp_die(
+				esc_html__('Payment or membership not found', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		// Check subscription status
+		if ('ACTIVE' === $subscription['status'] || 'APPROVED' === $subscription['status']) {
+			// Update membership
+			$membership->set_gateway('paypal-rest');
+			$membership->set_gateway_subscription_id($subscription_id);
+			$membership->set_gateway_customer_id($subscription['subscriber']['payer_id'] ?? '');
+			$membership->set_auto_renew(true);
+
+			// Handle based on status
+			if ('ACTIVE' === $subscription['status']) {
+				// Payment already processed
+				$payment->set_status(Payment_Status::COMPLETED);
+				$membership->renew(false);
+			} else {
+				// Will be activated on first payment webhook
+				$payment->set_status(Payment_Status::PENDING);
+			}
+
+			$payment->set_gateway('paypal-rest');
+			$payment->save();
+			$membership->save();
+
+			$this->log(sprintf('Subscription confirmed: %s, Status: %s', $subscription_id, $subscription['status']));
+
+			$this->payment = $payment;
+			wp_safe_redirect($this->get_return_url());
+			exit;
+		}
+
+		wp_die(
+			// translators: %s is the subscription status
+			esc_html(sprintf(__('Subscription not approved. Status: %s', 'ultimate-multisite'), $subscription['status'])),
+			esc_html__('PayPal Error', 'ultimate-multisite'),
+			['back_link' => true]
+		);
+	}
+
+	/**
+	 * Confirm an order after PayPal approval.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $token The PayPal order token.
+	 * @return void
+	 */
+	protected function confirm_order(string $token): void {
+
+		// Capture the order (Prefer header ensures full response with capture details)
+		$capture = $this->api_request('/v2/checkout/orders/' . $token . '/capture', [], 'POST', ['Prefer' => 'return=representation']);
+
+		if (is_wp_error($capture)) {
+			wp_die(
+				esc_html($capture->get_error_message()),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		if ('COMPLETED' !== $capture['status']) {
+			wp_die(
+				// translators: %s is the order status
+				esc_html(sprintf(__('Order not completed. Status: %s', 'ultimate-multisite'), $capture['status'])),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		// Parse custom_id
+		$purchase_unit = $capture['purchase_units'][0] ?? [];
+		$custom_parts  = explode('|', $purchase_unit['payments']['captures'][0]['custom_id'] ?? '');
+
+		if (count($custom_parts) !== 3) {
+			wp_die(
+				esc_html__('Invalid order data', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		[$payment_id, $membership_id, $customer_id] = $custom_parts;
+
+		$payment    = wu_get_payment($payment_id);
+		$membership = wu_get_membership($membership_id);
+
+		if (! $payment || ! $membership) {
+			wp_die(
+				esc_html__('Payment or membership not found', 'ultimate-multisite'),
+				esc_html__('PayPal Error', 'ultimate-multisite'),
+				['back_link' => true]
+			);
+		}
+
+		// Get transaction ID from capture
+		$transaction_id = $purchase_unit['payments']['captures'][0]['id'] ?? $token;
+
+		// Update payment
+		$payment->set_gateway('paypal-rest');
+		$payment->set_gateway_payment_id($transaction_id);
+		$payment->set_status(Payment_Status::COMPLETED);
+		$payment->save();
+
+		// Update membership
+		$membership->set_gateway('paypal-rest');
+		$membership->set_gateway_customer_id($capture['payer']['payer_id'] ?? '');
+		$membership->add_to_times_billed(1);
+		$membership->renew(false);
+
+		$this->log(sprintf('Order captured: %s, Transaction: %s', $token, $transaction_id));
+
+		$this->payment = $payment;
+		wp_safe_redirect($this->get_return_url());
+		exit;
+	}
+
+	/**
+	 * Process cancellation of a subscription.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer.
+	 * @return void
+	 */
+	public function process_cancellation($membership, $customer): void {
+
+		$subscription_id = $membership->get_gateway_subscription_id();
+
+		if (empty($subscription_id)) {
+			return;
+		}
+
+		$result = $this->api_request(
+			'/v1/billing/subscriptions/' . $subscription_id . '/cancel',
+			['reason' => __('Cancelled by user', 'ultimate-multisite')]
+		);
+
+		if (is_wp_error($result)) {
+			$this->log('Failed to cancel subscription: ' . $result->get_error_message(), LogLevel::ERROR);
+			return;
+		}
+
+		$this->log(sprintf('Subscription cancelled: %s', $subscription_id));
+	}
+
+	/**
+	 * Process refund.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param float                        $amount     The amount to refund.
+	 * @param \WP_Ultimo\Models\Payment    $payment    The payment.
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer.
+	 * @return void
+	 * @throws \Exception When refund fails.
+	 */
+	public function process_refund($amount, $payment, $membership, $customer): void {
+
+		$capture_id = $payment->get_gateway_payment_id();
+
+		if (empty($capture_id)) {
+			throw new \Exception(esc_html__('No capture ID found for this payment.', 'ultimate-multisite'));
+		}
+
+		$refund_data = [];
+
+		// Only include amount for partial refunds
+		if ($amount < $payment->get_total()) {
+			$refund_data['amount'] = [
+				'value'         => number_format($amount, 2, '.', ''),
+				'currency_code' => strtoupper($payment->get_currency()),
+			];
+		}
+
+		$result = $this->api_request('/v2/payments/captures/' . $capture_id . '/refund', $refund_data);
+
+		if (is_wp_error($result)) {
+			throw new \Exception(esc_html($result->get_error_message()));
+		}
+
+		$this->log(sprintf('Refund processed: %s for capture %s', $result['id'] ?? 'unknown', $capture_id));
+	}
+
+	/**
+	 * Reflects membership changes on the gateway.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param \WP_Ultimo\Models\Membership $membership The membership.
+	 * @param \WP_Ultimo\Models\Customer   $customer   The customer.
+	 * @return bool|\WP_Error
+	 */
+	public function process_membership_update(&$membership, $customer) {
+
+		$subscription_id = $membership->get_gateway_subscription_id();
+
+		if (empty($subscription_id)) {
+			return new \WP_Error(
+				'wu_paypal_no_subscription',
+				__('No subscription ID found for this membership.', 'ultimate-multisite')
+			);
+		}
+
+		// Note: PayPal subscription updates are limited
+		// For significant changes, may need to cancel and recreate
+		$this->log(sprintf('Membership update requested for subscription: %s', $subscription_id));
+
+		return true;
+	}
+
+	/**
+	 * Registers and enqueues the PayPal checkout scripts for button branding.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function register_scripts(): void {
+
+		wp_register_script(
+			'wu-paypal-rest',
+			wu_get_asset('gateways/paypal-rest.js', 'js'),
+			['wu-checkout'],
+			wu_get_version(),
+			true
+		);
+
+		wp_enqueue_script('wu-paypal-rest');
+	}
+
+	/**
+	 * Adds the PayPal REST Gateway settings to the settings screen.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function settings(): void {
+
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_header',
+			[
+				'title'           => __('PayPal', 'ultimate-multisite'),
+				'desc'            => __('Use the settings section below to configure PayPal as a payment method.', 'ultimate-multisite'),
+				'type'            => 'header',
+				'show_as_submenu' => true,
+				'require'         => [
+					'active_gateways' => 'paypal-rest',
+				],
+			]
+		);
+
+		// Sandbox mode toggle
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_sandbox_mode',
+			[
+				'title'     => __('PayPal Sandbox Mode', 'ultimate-multisite'),
+				'desc'      => __('Toggle this to put PayPal on sandbox mode. This is useful for testing and making sure PayPal is correctly setup to handle your payments.', 'ultimate-multisite'),
+				'type'      => 'toggle',
+				'default'   => 1,
+				'html_attr' => [
+					'v-model' => 'paypal_rest_sandbox_mode',
+				],
+				'require'   => [
+					'active_gateways' => 'paypal-rest',
+				],
+			]
+		);
+
+		// Currency support warning — shown when the store currency is not supported by PayPal
+		if (! self::is_currency_supported()) {
+			wu_register_settings_field(
+				'payment-gateways',
+				'paypal_rest_currency_notice',
+				[
+					'title'   => '',
+					'type'    => 'html',
+					'content' => [$this, 'render_currency_warning'],
+					'require' => [
+						'active_gateways' => 'paypal-rest',
+					],
+				]
+			);
+		}
+
+		$oauth_enabled = PayPal_OAuth_Handler::get_instance()->is_oauth_feature_enabled();
+
+		// PayPal Connect section — only shown when OAuth feature is enabled via proxy
+		if ($oauth_enabled) {
+			wu_register_settings_field(
+				'payment-gateways',
+				'paypal_rest_oauth_connection',
+				[
+					'title'   => __('PayPal Connect (Recommended)', 'ultimate-multisite'),
+					'desc'    => __('Connect your PayPal account securely with one click. This provides easier setup and automatic webhook configuration.', 'ultimate-multisite'),
+					'type'    => 'html',
+					'content' => [$this, 'render_oauth_connection'],
+					'require' => [
+						'active_gateways' => 'paypal-rest',
+					],
+				]
+			);
+
+			// Advanced: Show Direct API Keys Toggle (only when OAuth is available)
+			wu_register_settings_field(
+				'payment-gateways',
+				'paypal_rest_show_manual_keys',
+				[
+					'title'     => __('Use Direct API Keys (Advanced)', 'ultimate-multisite'),
+					'desc'      => __('Toggle to manually enter API keys instead of using PayPal Connect. Use this for backwards compatibility or advanced configurations.', 'ultimate-multisite'),
+					'type'      => 'toggle',
+					'default'   => 0,
+					'html_attr' => [
+						'v-model' => 'paypal_rest_show_manual_keys',
+					],
+					'require'   => [
+						'active_gateways' => 'paypal-rest',
+					],
+				]
+			);
+		}
+
+		// Build the require array for manual key fields.
+		// When OAuth is enabled, keys are behind the advanced toggle.
+		// When OAuth is disabled, keys are shown directly.
+		$sandbox_key_require = [
+			'active_gateways'          => 'paypal-rest',
+			'paypal_rest_sandbox_mode' => 1,
+		];
+
+		$live_key_require = [
+			'active_gateways'          => 'paypal-rest',
+			'paypal_rest_sandbox_mode' => 0,
+		];
+
+		if ($oauth_enabled) {
+			$sandbox_key_require['paypal_rest_show_manual_keys'] = 1;
+			$live_key_require['paypal_rest_show_manual_keys']    = 1;
+		}
+
+		// Sandbox Client ID
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_sandbox_client_id',
+			[
+				'title'       => __('Sandbox Client ID', 'ultimate-multisite'),
+				'placeholder' => __('e.g. AX7MV...', 'ultimate-multisite'),
+				'type'        => 'text',
+				'default'     => '',
+				'capability'  => 'manage_api_keys',
+				'require'     => $sandbox_key_require,
+			]
+		);
+
+		// Sandbox Client Secret
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_sandbox_client_secret',
+			[
+				'title'       => __('Sandbox Client Secret', 'ultimate-multisite'),
+				'placeholder' => __('e.g. EK4jT...', 'ultimate-multisite'),
+				'type'        => 'text',
+				'default'     => '',
+				'capability'  => 'manage_api_keys',
+				'require'     => $sandbox_key_require,
+			]
+		);
+
+		// Live Client ID
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_live_client_id',
+			[
+				'title'       => __('Live Client ID', 'ultimate-multisite'),
+				'placeholder' => __('e.g. AX7MV...', 'ultimate-multisite'),
+				'type'        => 'text',
+				'default'     => '',
+				'capability'  => 'manage_api_keys',
+				'require'     => $live_key_require,
+			]
+		);
+
+		// Live Client Secret
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_live_client_secret',
+			[
+				'title'       => __('Live Client Secret', 'ultimate-multisite'),
+				'placeholder' => __('e.g. EK4jT...', 'ultimate-multisite'),
+				'type'        => 'text',
+				'default'     => '',
+				'capability'  => 'manage_api_keys',
+				'require'     => $live_key_require,
+			]
+		);
+
+		$webhook_message = sprintf(
+			'<span class="wu-p-2 wu-bg-blue-100 wu-text-blue-600 wu-rounded wu-mt-3 wu-mb-0 wu-block wu-text-xs">%s</span>',
+			__('Webhooks are automatically configured when you connect your PayPal account or save settings with valid API credentials.', 'ultimate-multisite')
+		);
+
+		wu_register_settings_field(
+			'payment-gateways',
+			'paypal_rest_webhook_url',
+			[
+				'title'           => __('Webhook Listener URL', 'ultimate-multisite'),
+				'desc'            => $webhook_message,
+				'tooltip'         => __('This is the URL PayPal should send webhook calls to.', 'ultimate-multisite'),
+				'type'            => 'text-display',
+				'copy'            => true,
+				'default'         => $this->get_webhook_listener_url(),
+				'wrapper_classes' => '',
+				'require'         => [
+					'active_gateways' => 'paypal-rest',
+				],
+			]
+		);
+	}
+
+	/**
+	 * Render the PayPal OAuth connection status and button.
+	 *
+	 * Mirrors the Stripe Connect pattern: shows connected status with disconnect,
+	 * or disconnected status with connect button, plus fee notice.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function render_oauth_connection(): void {
+
+		$oauth        = PayPal_OAuth_Handler::get_instance();
+		$is_connected = $oauth->is_merchant_connected($this->test_mode);
+
+		if ($is_connected) {
+			$status     = $this->get_connection_status();
+			$mode_label = 'sandbox' === ($status['details']['mode'] ?? '')
+				? __('Sandbox', 'ultimate-multisite')
+				: __('Live', 'ultimate-multisite');
+			$identifier = $status['details']['merchant_id']
+				?? ($status['details']['email'] ?? ($status['details']['client_id'] ?? ''));
+
+			// Connected state
+			printf(
+				'<div class="wu-oauth-status wu-connected wu-p-4 wu-bg-green-50 wu-border wu-border-green-200 wu-rounded">
+					<div class="wu-flex wu-items-center wu-mb-2">
+						<span class="dashicons dashicons-yes-alt wu-text-green-600 wu-mr-2"></span>
+						<strong class="wu-text-green-800">%s</strong>
+					</div>
+					<p class="wu-text-sm wu-text-gray-600 wu-mb-2">%s <code class="wu-bg-white wu-px-2 wu-py-1 wu-rounded">%s</code> (%s)</p>
+					<button type="button" class="button wu-mt-2 wu-paypal-disconnect">%s</button>
+				</div>',
+				esc_html__('Connected via PayPal', 'ultimate-multisite'),
+				esc_html__('Merchant ID:', 'ultimate-multisite'),
+				esc_html($identifier),
+				esc_html($mode_label),
+				esc_html__('Disconnect', 'ultimate-multisite')
+			);
+		} else {
+
+			// Disconnected state - show connect button
+			$can_connect = $oauth->is_configured();
+
+			if ($can_connect) {
+				printf(
+					'<div class="wu-oauth-status wu-disconnected wu-p-4 wu-bg-blue-50 wu-border wu-border-blue-200 wu-rounded">
+						<p class="wu-text-sm wu-text-gray-700 wu-mb-3">%s</p>
+						<button type="button" class="button button-primary wu-paypal-connect">
+							<span class="dashicons dashicons-admin-links wu-mr-1 wu-mt-1"></span>
+							%s
+						</button>
+						<p class="wu-text-xs wu-text-gray-500 wu-mt-2">%s</p>
+					</div>',
+					esc_html__('Connect your PayPal account with one click. Webhooks will be configured automatically.', 'ultimate-multisite'),
+					esc_html__('Connect with PayPal', 'ultimate-multisite'),
+					esc_html__('You will be redirected to PayPal to securely authorize the connection.', 'ultimate-multisite')
+				);
+			} else {
+				printf(
+					'<div class="wu-oauth-status wu-disconnected wu-p-4 wu-bg-gray-50 wu-border wu-border-gray-200 wu-rounded">
+						<p class="wu-text-sm wu-text-gray-600">%s</p>
+					</div>',
+					esc_html__('Use the Direct API Keys option below to enter your PayPal credentials manually.', 'ultimate-multisite')
+				);
+			}
+		}
+
+		// Enqueue the connect/disconnect scripts
+		$this->enqueue_connect_scripts();
+
+		// Fee notice (mirrors Stripe Connect fee notice)
+		if (! \WP_Ultimo::get_instance()->get_addon_repository()->has_addon_purchase()) {
+			printf(
+				'<div class="wu-py-3">%s <br><a href="%s" target="_blank" rel="noopener">%s</a></div>',
+				esc_html(
+					sprintf(
+						/* translators: %s: the fee percentage */
+						__('There is a %s%% fee per-transaction to use the PayPal integration included in the free Ultimate Multisite plugin.', 'ultimate-multisite'),
+						number_format_i18n($this->get_platform_fee_percent(), 0)
+					)
+				),
+				esc_url(network_admin_url('admin.php?page=wp-ultimo-addons')),
+				esc_html__('Remove this fee by purchasing any addon and connecting your store.', 'ultimate-multisite')
+			);
+		} else {
+			printf(
+				'<p class="wu-text-xs wu-text-green-700 wu-mt-2">%s</p>',
+				esc_html__('No application fee — thank you for your support!', 'ultimate-multisite')
+			);
+		}
+	}
+
+	/**
+	 * Renders an admin notice when the store currency is not supported by PayPal.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function render_currency_warning(): void {
+
+		$currency = strtoupper((string) wu_get_setting('currency', 'USD'));
+		$docs_url = 'https://developer.paypal.com/docs/reports/reference/paypal-supported-currencies/';
+
+		printf(
+			'<div class="wu-p-3 wu-bg-yellow-50 wu-border wu-border-yellow-300 wu-rounded wu-text-sm wu-mb-4">
+				<p class="wu-font-semibold wu-text-yellow-800 wu-mb-1">&#9888; %s</p>
+				<p class="wu-text-yellow-700 wu-m-0">%s <a href="%s" target="_blank" rel="noopener noreferrer">%s</a></p>
+			</div>',
+			esc_html__('Unsupported Currency', 'ultimate-multisite'),
+			sprintf(
+				/* translators: %s: currency code such as "NGN" */
+				esc_html__('Your store currency (%s) is not supported by PayPal. PayPal will be hidden from the checkout until the currency is changed to a supported one.', 'ultimate-multisite'),
+				esc_html($currency)
+			),
+			esc_url($docs_url),
+			esc_html__('View supported currencies', 'ultimate-multisite')
+		);
+	}
+
+	/**
+	 * Enqueue the connect/disconnect button scripts.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	protected function enqueue_connect_scripts(): void {
+
+		static $enqueued = false;
+
+		if ($enqueued) {
+			return;
+		}
+
+		$enqueued = true;
+
+		// Capture values now; wp_kses strips data-* attributes from the button HTML,
+		// so we embed nonce and sandbox values directly in the footer script.
+		$nonce   = wp_create_nonce('wu_paypal_oauth');
+		$sandbox = $this->test_mode ? 1 : 0;
+
+		add_action(
+			'admin_footer',
+			function () use ($nonce, $sandbox) {
+				?>
+			<script>
+			jQuery(function($) {
+				var wuPayPalNonce = <?php echo wp_json_encode($nonce); ?>;
+				var wuPayPalSandbox = <?php echo (int) $sandbox; ?>;
+
+				$(".wu-paypal-connect").on("click", function(e) {
+					e.preventDefault();
+					var $btn = $(this);
+					$btn.prop("disabled", true).text(<?php echo wp_json_encode(__('Connecting...', 'ultimate-multisite')); ?>);
+
+					$.post(ajaxurl, {
+						action: "wu_paypal_connect",
+						nonce: wuPayPalNonce,
+						sandbox_mode: wuPayPalSandbox
+					}, function(response) {
+						if (response.success) {
+							window.location.href = response.data.redirect_url;
+						} else {
+							alert(response.data.message || <?php echo wp_json_encode(__('Connection failed. Please try again.', 'ultimate-multisite')); ?>);
+							$btn.prop("disabled", false).html('<span class="dashicons dashicons-admin-links wu-mr-1 wu-mt-1"></span> ' + <?php echo wp_json_encode(__('Connect with PayPal', 'ultimate-multisite')); ?>);
+						}
+					}).fail(function() {
+						alert(<?php echo wp_json_encode(__('Connection failed. Please try again.', 'ultimate-multisite')); ?>);
+						$btn.prop("disabled", false).html('<span class="dashicons dashicons-admin-links wu-mr-1 wu-mt-1"></span> ' + <?php echo wp_json_encode(__('Connect with PayPal', 'ultimate-multisite')); ?>);
+					});
+				});
+
+				$(".wu-paypal-disconnect").on("click", function(e) {
+					e.preventDefault();
+					if (!confirm(<?php echo wp_json_encode(__('Are you sure you want to disconnect PayPal?', 'ultimate-multisite')); ?>)) return;
+
+					var $btn = $(this);
+					$btn.prop("disabled", true);
+
+					$.post(ajaxurl, {
+						action: "wu_paypal_disconnect",
+						nonce: wuPayPalNonce
+					}, function(response) {
+						window.location.reload();
+					});
+				});
+			});
+			</script>
+				<?php
+			}
+		);
+	}
+
+	/**
+	 * Maybe install webhook after settings save.
+	 *
+	 * Automatically creates a webhook in PayPal when credentials are configured.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $settings         The final settings array.
+	 * @param array $settings_to_save Settings being updated.
+	 * @param array $saved_settings   Original settings.
+	 * @return void
+	 */
+	public function maybe_install_webhook($settings, $settings_to_save, $saved_settings): void {
+
+		$active_gateways = (array) wu_get_isset($settings_to_save, 'active_gateways', []);
+
+		if (! in_array('paypal-rest', $active_gateways, true)) {
+			return;
+		}
+
+		// Check if settings changed
+		$changed_settings = [
+			$settings['paypal_rest_sandbox_mode'] ?? '',
+			$settings['paypal_rest_sandbox_client_id'] ?? '',
+			$settings['paypal_rest_sandbox_client_secret'] ?? '',
+			$settings['paypal_rest_live_client_id'] ?? '',
+			$settings['paypal_rest_live_client_secret'] ?? '',
+		];
+
+		$original_settings = [
+			$saved_settings['paypal_rest_sandbox_mode'] ?? '',
+			$saved_settings['paypal_rest_sandbox_client_id'] ?? '',
+			$saved_settings['paypal_rest_sandbox_client_secret'] ?? '',
+			$saved_settings['paypal_rest_live_client_id'] ?? '',
+			$saved_settings['paypal_rest_live_client_secret'] ?? '',
+		];
+
+		// Only install if settings changed
+		if ($changed_settings === $original_settings) {
+			return;
+		}
+
+		// Reload credentials with new settings
+		$this->test_mode = (bool) (int) ($settings['paypal_rest_sandbox_mode'] ?? true);
+		$this->load_credentials();
+
+		// Check if we have credentials
+		if (! $this->is_configured()) {
+			return;
+		}
+
+		$this->install_webhook();
+	}
+
+	/**
+	 * Install webhook in PayPal.
+	 *
+	 * @since 2.0.0
+	 * @return bool|\WP_Error True on success, WP_Error on failure.
+	 */
+	public function install_webhook() {
+
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+
+		// Check if we already have a webhook installed
+		$existing_webhook_id = wu_get_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+
+		if (! empty($existing_webhook_id)) {
+			// Verify it still exists
+			$existing = $this->api_request('/v1/notifications/webhooks/' . $existing_webhook_id, [], 'GET');
+
+			if (! is_wp_error($existing) && ! empty($existing['id'])) {
+				$this->log(sprintf('Webhook already exists: %s', $existing_webhook_id));
+				return true;
+			}
+
+			// Webhook was deleted, clear the setting
+			wu_save_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+		}
+
+		$webhook_url = $this->get_webhook_listener_url();
+
+		// Define the events we want to receive
+		$event_types = [
+			['name' => 'BILLING.SUBSCRIPTION.CREATED'],
+			['name' => 'BILLING.SUBSCRIPTION.ACTIVATED'],
+			['name' => 'BILLING.SUBSCRIPTION.UPDATED'],
+			['name' => 'BILLING.SUBSCRIPTION.CANCELLED'],
+			['name' => 'BILLING.SUBSCRIPTION.SUSPENDED'],
+			['name' => 'BILLING.SUBSCRIPTION.PAYMENT.FAILED'],
+			['name' => 'PAYMENT.SALE.COMPLETED'],
+			['name' => 'PAYMENT.CAPTURE.COMPLETED'],
+			['name' => 'PAYMENT.CAPTURE.REFUNDED'],
+		];
+
+		$webhook_data = [
+			'url'         => $webhook_url,
+			'event_types' => $event_types,
+		];
+
+		$this->log(sprintf('Creating webhook for URL: %s', $webhook_url));
+
+		$result = $this->api_request('/v1/notifications/webhooks', $webhook_data);
+
+		if (is_wp_error($result)) {
+			$this->log(sprintf('Failed to create webhook: %s', $result->get_error_message()), LogLevel::ERROR);
+			return $result;
+		}
+
+		if (empty($result['id'])) {
+			$this->log('Webhook created but no ID returned', LogLevel::ERROR);
+			return new \WP_Error('wu_paypal_webhook_no_id', __('Webhook created but no ID returned', 'ultimate-multisite'));
+		}
+
+		// Save the webhook ID
+		wu_save_setting("paypal_rest_{$mode_prefix}_webhook_id", $result['id']);
+
+		$this->log(sprintf('Webhook created successfully: %s', $result['id']));
+
+		return true;
+	}
+
+	/**
+	 * Check if webhook is installed.
+	 *
+	 * @since 2.0.0
+	 * @return bool|array False if not installed, webhook data if installed.
+	 */
+	public function has_webhook_installed() {
+
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+		$webhook_id  = wu_get_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+
+		if (empty($webhook_id)) {
+			return false;
+		}
+
+		$webhook = $this->api_request('/v1/notifications/webhooks/' . $webhook_id, [], 'GET');
+
+		if (is_wp_error($webhook)) {
+			return false;
+		}
+
+		return $webhook;
+	}
+
+	/**
+	 * Delete webhook from PayPal.
+	 *
+	 * @since 2.0.0
+	 * @return bool True on success.
+	 */
+	public function delete_webhook(): bool {
+
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+		$webhook_id  = wu_get_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+
+		if (empty($webhook_id)) {
+			return true;
+		}
+
+		$result = $this->api_request('/v1/notifications/webhooks/' . $webhook_id, [], 'DELETE');
+
+		// Clear the stored webhook ID regardless of result
+		wu_save_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+
+		if (is_wp_error($result)) {
+			$this->log(sprintf('Failed to delete webhook: %s', $result->get_error_message()), LogLevel::WARNING);
+			return false;
+		}
+
+		$this->log(sprintf('Webhook deleted: %s', $webhook_id));
+
+		return true;
+	}
+
+	/**
+	 * AJAX handler to manually install webhook.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function ajax_install_webhook(): void {
+
+		check_ajax_referer('wu_paypal_webhook', 'nonce');
+
+		if (! current_user_can('manage_network_options')) {
+			wp_send_json_error(
+				[
+					'message' => __('You do not have permission to do this.', 'ultimate-multisite'),
+				]
+			);
+		}
+
+		// Reload credentials to ensure we have the latest
+		$this->load_credentials();
+
+		if (! $this->is_configured()) {
+			wp_send_json_error(
+				[
+					'message' => __('PayPal credentials are not configured.', 'ultimate-multisite'),
+				]
+			);
+		}
+
+		$result = $this->install_webhook();
+
+		if (true === $result) {
+			wp_send_json_success(
+				[
+					'message' => __('Webhook configured successfully.', 'ultimate-multisite'),
+				]
+			);
+		} elseif (is_wp_error($result)) {
+			wp_send_json_error(
+				[
+					'message' => $result->get_error_message(),
+				]
+			);
+		} else {
+			wp_send_json_error(
+				[
+					'message' => __('Failed to configure webhook. Please try again.', 'ultimate-multisite'),
+				]
+			);
+		}
+	}
+}
diff --git a/inc/gateways/class-paypal-webhook-handler.php b/inc/gateways/class-paypal-webhook-handler.php
new file mode 100644
index 000000000..e571db1d0
--- /dev/null
+++ b/inc/gateways/class-paypal-webhook-handler.php
@@ -0,0 +1,587 @@
+<?php
+/**
+ * PayPal REST Webhook Handler.
+ *
+ * Handles webhook notifications from PayPal REST API for subscriptions and payments.
+ * Uses PayPal's webhook signature verification for security.
+ *
+ * @package WP_Ultimo
+ * @subpackage Gateways
+ * @since 2.0.0
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use Psr\Log\LogLevel;
+use WP_Ultimo\Database\Payments\Payment_Status;
+use WP_Ultimo\Database\Memberships\Membership_Status;
+
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+/**
+ * PayPal REST Webhook Handler class.
+ *
+ * @since 2.0.0
+ */
+class PayPal_Webhook_Handler {
+
+	use \WP_Ultimo\Traits\Singleton;
+
+	/**
+	 * Holds if we are in test mode.
+	 *
+	 * @since 2.0.0
+	 * @var bool
+	 */
+	protected $test_mode = true;
+
+	/**
+	 * Initialize the webhook handler.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function init(): void {
+
+		$this->test_mode = (bool) (int) wu_get_setting('paypal_rest_sandbox_mode', true);
+
+		// Register webhook listener
+		add_action('wu_paypal-rest_process_webhooks', [$this, 'process_webhook']);
+	}
+
+	/**
+	 * Returns the PayPal API base URL based on test mode.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	protected function get_api_base_url(): string {
+
+		return $this->test_mode ? 'https://api-m.sandbox.paypal.com' : 'https://api-m.paypal.com';
+	}
+
+	/**
+	 * Process incoming webhook.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function process_webhook(): void {
+
+		$raw_body = file_get_contents('php://input');
+
+		if (empty($raw_body)) {
+			$this->log('Webhook received with empty body', LogLevel::WARNING);
+			status_header(400);
+			exit;
+		}
+
+		$event = json_decode($raw_body, true);
+
+		if (json_last_error() !== JSON_ERROR_NONE || empty($event['event_type'])) {
+			$this->log('Webhook received with invalid JSON', LogLevel::WARNING);
+			status_header(400);
+			exit;
+		}
+
+		$this->log(sprintf('Webhook received: %s, ID: %s', $event['event_type'], $event['id'] ?? 'unknown'));
+
+		// Verify webhook signature
+		if (! $this->verify_webhook_signature($raw_body)) {
+			$this->log('Webhook signature verification failed', LogLevel::ERROR);
+			status_header(401);
+			exit;
+		}
+
+		// Process based on event type
+		$event_type = $event['event_type'];
+		$resource   = $event['resource'] ?? [];
+
+		switch ($event_type) {
+			// Subscription events
+			case 'BILLING.SUBSCRIPTION.CREATED':
+				$this->handle_subscription_created($resource);
+				break;
+
+			case 'BILLING.SUBSCRIPTION.ACTIVATED':
+				$this->handle_subscription_activated($resource);
+				break;
+
+			case 'BILLING.SUBSCRIPTION.UPDATED':
+				$this->handle_subscription_updated($resource);
+				break;
+
+			case 'BILLING.SUBSCRIPTION.CANCELLED':
+				$this->handle_subscription_cancelled($resource);
+				break;
+
+			case 'BILLING.SUBSCRIPTION.SUSPENDED':
+				$this->handle_subscription_suspended($resource);
+				break;
+
+			case 'BILLING.SUBSCRIPTION.PAYMENT.FAILED':
+				$this->handle_subscription_payment_failed($resource);
+				break;
+
+			// Payment events
+			case 'PAYMENT.SALE.COMPLETED':
+				$this->handle_payment_completed($resource);
+				break;
+
+			case 'PAYMENT.CAPTURE.COMPLETED':
+				$this->handle_capture_completed($resource);
+				break;
+
+			case 'PAYMENT.CAPTURE.REFUNDED':
+				$this->handle_capture_refunded($resource);
+				break;
+
+			default:
+				$this->log(sprintf('Unhandled webhook event: %s', $event_type));
+				break;
+		}
+
+		status_header(200);
+		exit;
+	}
+
+	/**
+	 * Verify the webhook signature.
+	 *
+	 * PayPal REST webhooks use RSA-SHA256 signatures for verification.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $raw_body The raw request body.
+	 * @return bool
+	 */
+	protected function verify_webhook_signature(string $raw_body): bool {
+
+		// Get webhook headers - these come from PayPal's webhook signature
+		$auth_algo         = isset($_SERVER['HTTP_PAYPAL_AUTH_ALGO']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_PAYPAL_AUTH_ALGO'])) : '';
+		$cert_url          = isset($_SERVER['HTTP_PAYPAL_CERT_URL']) ? sanitize_url(wp_unslash($_SERVER['HTTP_PAYPAL_CERT_URL'])) : '';
+		$transmission_id   = isset($_SERVER['HTTP_PAYPAL_TRANSMISSION_ID']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_PAYPAL_TRANSMISSION_ID'])) : '';
+		$transmission_sig  = isset($_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG'])) : '';
+		$transmission_time = isset($_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME'])) : '';
+
+		// If headers are missing, we can't verify
+		if (empty($auth_algo) || empty($cert_url) || empty($transmission_id) || empty($transmission_sig) || empty($transmission_time)) {
+			$this->log('Missing webhook signature headers', LogLevel::WARNING);
+
+			/**
+			 * Filters whether to skip webhook signature verification.
+			 *
+			 * Only use this for local development or testing environments.
+			 *
+			 * @since 2.0.0
+			 *
+			 * @param bool $skip Whether to skip verification. Default false.
+			 */
+			if (apply_filters('wu_paypal_skip_webhook_verification', false)) {
+				$this->log('Skipping signature verification via filter');
+				return true;
+			}
+
+			return false;
+		}
+
+		// Get webhook ID from settings
+		$mode_prefix = $this->test_mode ? 'sandbox' : 'live';
+		$webhook_id  = wu_get_setting("paypal_rest_{$mode_prefix}_webhook_id", '');
+
+		if (empty($webhook_id)) {
+			$this->log('Webhook ID not configured, cannot verify signature', LogLevel::WARNING);
+			return false;
+		}
+
+		// Get access token for verification API call
+		$gateway = wu_get_gateway('paypal-rest');
+		if (! $gateway) {
+			$this->log('PayPal REST gateway not available', LogLevel::ERROR);
+			return false;
+		}
+
+		// Build verification request
+		$verify_data = [
+			'auth_algo'         => $auth_algo,
+			'cert_url'          => $cert_url,
+			'transmission_id'   => $transmission_id,
+			'transmission_sig'  => $transmission_sig,
+			'transmission_time' => $transmission_time,
+			'webhook_id'        => $webhook_id,
+			'webhook_event'     => json_decode($raw_body, true),
+		];
+
+		// Get client credentials
+		$client_id     = wu_get_setting("paypal_rest_{$mode_prefix}_client_id", '');
+		$client_secret = wu_get_setting("paypal_rest_{$mode_prefix}_client_secret", '');
+
+		if (empty($client_id) || empty($client_secret)) {
+			$this->log('Client credentials not configured for webhook verification', LogLevel::WARNING);
+			return false;
+		}
+
+		// Get access token
+		$token_response = wp_remote_post(
+			$this->get_api_base_url() . '/v1/oauth2/token',
+			[
+				'headers' => [
+					'Authorization' => 'Basic ' . base64_encode($client_id . ':' . $client_secret), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Required for PayPal API Basic auth
+					'Content-Type'  => 'application/x-www-form-urlencoded',
+				],
+				'body'    => 'grant_type=client_credentials',
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($token_response)) {
+			$this->log('Failed to get token for webhook verification: ' . $token_response->get_error_message(), LogLevel::ERROR);
+			return false;
+		}
+
+		$token_body   = json_decode(wp_remote_retrieve_body($token_response), true);
+		$access_token = $token_body['access_token'] ?? '';
+
+		if (empty($access_token)) {
+			$this->log('Failed to get access token for webhook verification', LogLevel::ERROR);
+			return false;
+		}
+
+		// Call verification endpoint
+		$verify_response = wp_remote_post(
+			$this->get_api_base_url() . '/v1/notifications/verify-webhook-signature',
+			[
+				'headers' => [
+					'Authorization' => 'Bearer ' . $access_token,
+					'Content-Type'  => 'application/json',
+				],
+				'body'    => wp_json_encode($verify_data),
+				'timeout' => 30,
+			]
+		);
+
+		if (is_wp_error($verify_response)) {
+			$this->log('Webhook verification request failed: ' . $verify_response->get_error_message(), LogLevel::ERROR);
+			return false;
+		}
+
+		$verify_body = json_decode(wp_remote_retrieve_body($verify_response), true);
+
+		if (($verify_body['verification_status'] ?? '') === 'SUCCESS') {
+			$this->log('Webhook signature verified successfully');
+			return true;
+		}
+
+		$this->log(sprintf('Webhook signature verification returned: %s', $verify_body['verification_status'] ?? 'unknown'), LogLevel::WARNING);
+
+		return false;
+	}
+
+	/**
+	 * Handle subscription created event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_created(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+		$this->log(sprintf('Subscription created: %s', $subscription_id));
+
+		// Subscription created is usually handled during checkout flow
+		// This webhook is mainly for logging/verification
+	}
+
+	/**
+	 * Handle subscription activated event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_activated(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+
+		$membership = $this->get_membership_by_subscription($subscription_id);
+
+		if (! $membership) {
+			$this->log(sprintf('Subscription activated but no membership found: %s', $subscription_id), LogLevel::WARNING);
+			return;
+		}
+
+		// Update membership status if needed
+		if ($membership->get_status() !== Membership_Status::ACTIVE) {
+			$membership->set_status(Membership_Status::ACTIVE);
+			$membership->save();
+
+			$this->log(sprintf('Membership %d activated via webhook', $membership->get_id()));
+		}
+	}
+
+	/**
+	 * Handle subscription updated event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_updated(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+		$this->log(sprintf('Subscription updated: %s', $subscription_id));
+
+		// Handle any subscription updates as needed
+	}
+
+	/**
+	 * Handle subscription cancelled event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_cancelled(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+
+		$membership = $this->get_membership_by_subscription($subscription_id);
+
+		if (! $membership) {
+			$this->log(sprintf('Subscription cancelled but no membership found: %s', $subscription_id), LogLevel::WARNING);
+			return;
+		}
+
+		// Cancel at end of period
+		$membership->set_auto_renew(false);
+		$membership->save();
+
+		$this->log(sprintf('Membership %d set to not auto-renew after cancellation', $membership->get_id()));
+	}
+
+	/**
+	 * Handle subscription suspended event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_suspended(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+
+		$membership = $this->get_membership_by_subscription($subscription_id);
+
+		if (! $membership) {
+			$this->log(sprintf('Subscription suspended but no membership found: %s', $subscription_id), LogLevel::WARNING);
+			return;
+		}
+
+		$membership->set_status(Membership_Status::ON_HOLD);
+		$membership->save();
+
+		$this->log(sprintf('Membership %d suspended via webhook', $membership->get_id()));
+	}
+
+	/**
+	 * Handle subscription payment failed event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The subscription event data.
+	 * @return void
+	 */
+	protected function handle_subscription_payment_failed(array $event_data): void {
+
+		$subscription_id = $event_data['id'] ?? '';
+
+		$membership = $this->get_membership_by_subscription($subscription_id);
+
+		if (! $membership) {
+			$this->log(sprintf('Subscription payment failed but no membership found: %s', $subscription_id), LogLevel::WARNING);
+			return;
+		}
+
+		$this->log(sprintf('Payment failed for membership %d, subscription %s', $membership->get_id(), $subscription_id));
+
+		// Optionally record a failed payment
+		// The membership status might be updated by PayPal's retry logic
+	}
+
+	/**
+	 * Handle payment sale completed event.
+	 *
+	 * This is triggered for subscription payments.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The sale event data.
+	 * @return void
+	 */
+	protected function handle_payment_completed(array $event_data): void {
+
+		$sale_id    = $event_data['id'] ?? '';
+		$billing_id = $event_data['billing_agreement_id'] ?? '';
+		$custom_id  = $event_data['custom'] ?? ($event_data['custom_id'] ?? '');
+		$amount     = $event_data['amount']['total'] ?? ($event_data['amount']['value'] ?? 0);
+		$currency   = $event_data['amount']['currency'] ?? ($event_data['amount']['currency_code'] ?? 'USD');
+
+		$this->log(sprintf('Payment completed: %s, Amount: %s %s', $sale_id, $amount, $currency));
+
+		// Try to find membership by billing agreement (subscription ID)
+		$membership = null;
+		if (! empty($billing_id)) {
+			$membership = $this->get_membership_by_subscription($billing_id);
+		}
+
+		// Fallback to custom_id parsing
+		if (! $membership && ! empty($custom_id)) {
+			$custom_parts = explode('|', $custom_id);
+			if (count($custom_parts) >= 2) {
+				$membership = wu_get_membership((int) $custom_parts[1]);
+			}
+		}
+
+		if (! $membership) {
+			$this->log(sprintf('Payment completed but no membership found for sale: %s', $sale_id), LogLevel::WARNING);
+			return;
+		}
+
+		// Check if this is a renewal payment (not initial)
+		$existing_payment = wu_get_payment_by('gateway_payment_id', $sale_id);
+
+		if ($existing_payment) {
+			$this->log(sprintf('Payment %s already recorded', $sale_id));
+			return;
+		}
+
+		// Create renewal payment
+		$payment_data = [
+			'customer_id'        => $membership->get_customer_id(),
+			'membership_id'      => $membership->get_id(),
+			'gateway'            => 'paypal-rest',
+			'gateway_payment_id' => $sale_id,
+			'currency'           => $currency,
+			'subtotal'           => (float) $amount,
+			'total'              => (float) $amount,
+			'status'             => Payment_Status::COMPLETED,
+			'product_id'         => $membership->get_plan_id(),
+		];
+
+		$payment = wu_create_payment($payment_data);
+
+		if (is_wp_error($payment)) {
+			$this->log(sprintf('Failed to create renewal payment: %s', $payment->get_error_message()), LogLevel::ERROR);
+			return;
+		}
+
+		// Update membership
+		$membership->add_to_times_billed(1);
+		$membership->renew(false);
+
+		$this->log(sprintf('Renewal payment created: %d for membership %d', $payment->get_id(), $membership->get_id()));
+	}
+
+	/**
+	 * Handle capture completed event.
+	 *
+	 * This is triggered for one-time payments.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The capture event data.
+	 * @return void
+	 */
+	protected function handle_capture_completed(array $event_data): void {
+
+		$capture_id = $event_data['id'] ?? '';
+		$this->log(sprintf('Capture completed: %s', $capture_id));
+
+		// Capture completed is usually handled during the confirmation flow
+		// This webhook is for verification/edge cases
+	}
+
+	/**
+	 * Handle capture refunded event.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $event_data The refund event data.
+	 * @return void
+	 */
+	protected function handle_capture_refunded(array $event_data): void {
+
+		$refund_id  = $event_data['id'] ?? '';
+		$capture_id = '';
+		$amount     = $event_data['amount']['value'] ?? 0;
+
+		// Find the original capture ID from links
+		foreach ($event_data['links'] ?? [] as $link) {
+			if ('up' === $link['rel']) {
+				// Extract capture ID from the link
+				preg_match('/captures\/([A-Z0-9]+)/', $link['href'], $matches);
+				$capture_id = $matches[1] ?? '';
+				break;
+			}
+		}
+
+		$this->log(sprintf('Refund processed: %s for capture %s, Amount: %s', $refund_id, $capture_id, $amount));
+
+		if (empty($capture_id)) {
+			return;
+		}
+
+		// Find the payment
+		$payment = wu_get_payment_by('gateway_payment_id', $capture_id);
+
+		if (! $payment) {
+			$this->log(sprintf('Refund webhook: payment not found for capture %s', $capture_id), LogLevel::WARNING);
+			return;
+		}
+
+		// Update payment status if fully refunded
+		if ($amount >= $payment->get_total()) {
+			$payment->set_status(Payment_Status::REFUND);
+			$payment->save();
+			$this->log(sprintf('Payment %d marked as refunded', $payment->get_id()));
+		}
+	}
+
+	/**
+	 * Get membership by PayPal subscription ID.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $subscription_id The PayPal subscription ID.
+	 * @return \WP_Ultimo\Models\Membership|null
+	 */
+	protected function get_membership_by_subscription(string $subscription_id) {
+
+		if (empty($subscription_id)) {
+			return null;
+		}
+
+		return wu_get_membership_by('gateway_subscription_id', $subscription_id);
+	}
+
+	/**
+	 * Log a message.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param string $message The message to log.
+	 * @param string $level   Log level.
+	 * @return void
+	 */
+	protected function log(string $message, string $level = 'info'): void {
+
+		wu_log_add('paypal', '[Webhook] ' . $message, $level);
+	}
+}
diff --git a/inc/integrations/host-providers/class-base-host-provider.php b/inc/integrations/host-providers/class-base-host-provider.php
new file mode 100644
index 000000000..b524e6910
--- /dev/null
+++ b/inc/integrations/host-providers/class-base-host-provider.php
@@ -0,0 +1,656 @@
+<?php
+/**
+ * Base class that new host providers integrations must extend.
+ *
+ * @package WP_Ultimo
+ * @subpackage Integrations/Host_Providers
+ * @since 2.0.0
+ */
+
+namespace WP_Ultimo\Integrations\Host_Providers;
+
+use WP_Ultimo\Helpers\WP_Config;
+
+// Exit if accessed directly
+defined('ABSPATH') || exit;
+
+/**
+ * This base class should be extended to implement new host integrations for SSL and domains.
+ */
+abstract class Base_Host_Provider {
+
+	/**
+	 * Holds the id of the integration.
+	 *
+	 * @var string
+	 * @since 2.0.0
+	 */
+	protected $id;
+
+	/**
+	 * Keeps the title of the integration.
+	 *
+	 * @var string
+	 * @since 2.0.0
+	 */
+	protected $title;
+
+	/**
+	 * Link to the tutorial teaching how to make this integration work.
+	 *
+	 * @var string
+	 * @since 2.0.0
+	 */
+	protected $tutorial_link = '';
+
+	/**
+	 * Array containing the features this integration supports.
+	 *
+	 * @var array
+	 * @since 2.0.0
+	 */
+	protected $supports = [];
+
+	/**
+	 * Constants that need to be present on wp-config.php for this integration to work.
+	 * The values can be strings or array with constants to check for a match.
+	 *
+	 * @since 2.0.0
+	 * @var array
+	 */
+	protected $constants = [];
+
+	/**
+	 * Constants that are optional on wp-config.php.
+	 *
+	 * @since 2.0.0
+	 * @var array
+	 */
+	protected $optional_constants = [];
+
+	/**
+	 * Runs on singleton instantiation.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function init(): void {
+
+		if ($this->detect() && ! $this->is_enabled()) {
+			/*
+			 * Adds an admin notice telling the admin that they should probably enable this integration.
+			 */
+			$this->alert_provider_detected();
+		}
+
+		/*
+		 * Only add hooks if the integration is enabled and correctly setup.
+		 */
+		if ($this->is_enabled()) {
+			/*
+			 * Checks if everything was correctly setup.
+			 */
+			if ( ! $this->is_setup()) {
+				/*
+				 * Adds an admin notice telling the admin that the provider is not correctly setup.
+				 */
+				if (did_action('init')) {
+					$this->alert_provider_not_setup();
+				} else {
+					// avoid text domain loaded at the wrong time.
+					add_action('init', [$this, 'alert_provider_not_setup']);
+				}
+			} else {
+				/*
+				 * Load the dependencies.
+				 */
+				$this->load_dependencies();
+
+				/*
+				 * Initialize the hooks.
+				 */
+				$this->register_hooks();
+			}
+		}
+
+		add_filter('wu_domain_manager_get_integrations', [$this, 'self_register']);
+
+		add_action('init', [$this, 'add_to_integration_list']);
+	}
+
+	/**
+	 * Let the class register itself on the manager, allowing us to access the integrations later via the slug.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $integrations List of integrations added so far.
+	 * @return array
+	 */
+	final public function self_register($integrations) {
+
+		$integrations[ $this->get_id() ] = static::class;
+
+		return $integrations;
+	}
+
+	/**
+	 * Get the list of enabled host integrations.
+	 *
+	 * @since 2.0.0
+	 * @return array
+	 */
+	protected function get_enabled_list() {
+
+		return get_network_option(null, 'wu_host_integrations_enabled', []);
+	}
+
+	/**
+	 * Check if this integration is enabled.
+	 *
+	 * @since 2.0.0
+	 * @return boolean
+	 */
+	final public function is_enabled() {
+
+		$list = $this->get_enabled_list();
+
+		return wu_get_isset($list, $this->get_id(), false);
+	}
+
+	/**
+	 * Enables this integration.
+	 *
+	 * @since 2.0.0
+	 * @return boolean
+	 */
+	public function enable() {
+
+		$list = $this->get_enabled_list();
+
+		$list[ $this->get_id() ] = true;
+
+		return update_network_option(null, 'wu_host_integrations_enabled', $list);
+	}
+
+	/**
+	 * Disables this integration.
+	 *
+	 * @since 2.0.0
+	 * @return boolean
+	 */
+	public function disable() {
+
+		$list = $this->get_enabled_list();
+
+		$list[ $this->get_id() ] = false;
+
+		return update_network_option(null, 'wu_host_integrations_enabled', $list);
+	}
+
+	/**
+	 * Adds the host to the list of integrations.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function add_to_integration_list(): void {
+
+		$slug = $this->get_id();
+
+		$html = $this->is_enabled() ? sprintf('<div class="wu-self-center wu-text-green-800 wu-mr-4"><span class="dashicons-wu-check"></span> %s</div>', __('Activated', 'ultimate-multisite')) : '';
+
+		$url = wu_network_admin_url(
+			'wp-ultimo-hosting-integration-wizard',
+			[
+				'integration' => $slug,
+			]
+		);
+
+		$html .= sprintf('<a href="%s" class="button-primary">%s</a>', $url, __('Configuration', 'ultimate-multisite'));
+
+		// translators: %s is the name of a host provider (e.g. Cloudways, WPMUDev, Closte...).
+		$title = sprintf(__('%s Integration', 'ultimate-multisite'), $this->get_title());
+
+		$title .= sprintf(
+			"<span class='wu-normal-case wu-block wu-text-xs wu-font-normal wu-mt-1'>%s</span>",
+			__('Go to the setup wizard to setup this integration.', 'ultimate-multisite')
+		);
+
+		wu_register_settings_field(
+			'integrations',
+			'integration_' . str_replace('-', '_', $slug),
+			[
+				'type'  => 'note',
+				'title' => $title,
+				'desc'  => $html,
+			]
+		);
+	}
+
+	/**
+	 * Adds an admin notice telling the admin that they should probably enable this integration.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function alert_provider_detected(): void {
+
+		if (WP_Ultimo()->is_loaded() === false) {
+			return;
+		}
+
+		// translators: %1$s will be replaced with the integration title. E.g. RunCloud
+		$message = sprintf(__('It looks like you are using %1$s as your hosting provider, yet the %1$s integration module is not active. In order for the domain mapping integration to work with %1$s, you might want to activate that module.', 'ultimate-multisite'), $this->get_title());
+
+		$slug = $this->get_id();
+
+		$actions = [
+			'activate' => [
+				// translators: %s is the integration name.
+				'title' => sprintf(__('Activate %s', 'ultimate-multisite'), $this->get_title()),
+				'url'   => wu_network_admin_url(
+					'wp-ultimo-hosting-integration-wizard',
+					[
+						'integration' => $slug,
+					]
+				),
+			],
+		];
+
+		WP_Ultimo()->notices->add($message, 'info', 'network-admin', "should-enable-{$slug}-integration", $actions);
+	}
+
+	/**
+	 * Adds an admin notice telling the admin that the provider is not correctly setup.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function alert_provider_not_setup(): void {
+
+		if (WP_Ultimo()->is_loaded() === false) {
+			return;
+		}
+
+		// translators: %1$s will be replaced with the integration title. E.g. RunCloud.
+		$message = sprintf(__('It looks like you are using %1$s as your hosting provider, yet the %1$s integration module was not properly setup. In order for the domain mapping integration to work with %1$s, you need to configure that module.', 'ultimate-multisite'), $this->get_title());
+
+		$slug = $this->get_id();
+
+		$actions = [
+			'activate' => [
+				// translators: %s is the integration name
+				'title' => sprintf(__('Setup %s', 'ultimate-multisite'), $this->get_title()),
+				'url'   => wu_network_admin_url(
+					'wp-ultimo-hosting-integration-wizard',
+					[
+						'integration' => $slug,
+						'tab'         => 'config',
+					]
+				),
+			],
+		];
+
+		WP_Ultimo()->notices->add($message, 'warning', 'network-admin', "should-setup-{$slug}-integration", $actions);
+	}
+
+	/**
+	 * Get Fields for the integration.
+	 *
+	 * @since 2.0.0
+	 * @return array
+	 */
+	public function get_fields() {
+
+		return [];
+	}
+
+	/**
+	 * Returns the integration id.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	public function get_id() {
+
+		return $this->id;
+	}
+
+	/**
+	 * Returns the integration title.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	public function get_title() {
+
+		return $this->title;
+	}
+
+	/**
+	 * Checks if a feature is supported, like auto-ssl for example.
+	 *
+	 * @since 2.0.0
+	 * @param string $feature Feature to check.
+	 * @return boolean
+	 */
+	public function supports($feature) {
+
+		return apply_filters('wu_hosting_support_supports', in_array($feature, $this->supports, true), $this);
+	}
+
+	/**
+	 * Initializes the hooks.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function register_hooks(): void {
+		/*
+		 * Hooks the event that is triggered when a new domain is added.
+		 */
+		add_action('wu_add_domain', [$this, 'on_add_domain'], 10, 2);
+
+		/*
+		 * Hooks the event that is triggered when a domain is deleted.
+		 */
+		add_action('wu_remove_domain', [$this, 'on_remove_domain'], 10, 2);
+
+		/*
+		 * Hooks the event that is triggered when a sub-domain is added.
+		 */
+		add_action('wu_add_subdomain', [$this, 'on_add_subdomain'], 10, 2);
+
+		/*
+		 * Hooks the event that is triggered when a sub-domain is added.
+		 */
+		add_action('wu_remove_subdomain', [$this, 'on_remove_subdomain'], 10, 2);
+
+		/*
+		 * Add additional hooks.
+		 */
+		$this->additional_hooks();
+	}
+
+	/**
+	 * Lets integrations add additional hooks.
+	 *
+	 * @since 2.0.7
+	 * @return void
+	 */
+	public function additional_hooks() {}
+
+	/**
+	 * Can be used to load dependencies.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function load_dependencies() {}
+
+	/**
+	 * Picks up on tips that a given host provider is being used.
+	 *
+	 * We use this to suggest that the user should activate an integration module.
+	 *
+	 * @since 2.0.0
+	 * @return boolean
+	 */
+	abstract public function detect();
+
+	/**
+	 * Checks if the integration is correctly setup after enabled.
+	 *
+	 * @since 2.0.0
+	 * @return boolean
+	 */
+	public function is_setup() {
+
+		$all_set = true;
+
+		foreach ($this->constants as $constant) {
+			$constants = is_array($constant) ? $constant : [$constant];
+
+			$current = false;
+
+			foreach ($constants as $constant) {
+				if (defined($constant) && constant($constant)) {
+					$current = true;
+
+					break;
+				}
+			}
+
+			$all_set = $all_set && $current;
+
+			/*
+			 * If any constant fail, bail.
+			 */
+			if (false === $all_set) {
+				return false;
+			}
+		}
+
+		return $all_set;
+	}
+
+	/**
+	 * Returns a list of missing constants configured on wp-config.php
+	 *
+	 * @since 2.0.14
+	 * @return array
+	 */
+	public function get_missing_constants() {
+
+		$missing_constants = [];
+
+		foreach ($this->constants as $constant) {
+			$constants = is_array($constant) ? $constant : [$constant];
+
+			$current = false;
+
+			foreach ($constants as $constant) {
+				if (defined($constant) && constant($constant)) {
+					$current = true;
+
+					break;
+				}
+			}
+
+			$missing_constants = $current ? $missing_constants : array_merge($missing_constants, $constants);
+		}
+
+		return $missing_constants;
+	}
+
+	/**
+	 * Returns a list of all constants, optional or not.
+	 *
+	 * @since 2.0.0
+	 * @return array
+	 */
+	public function get_all_constants() {
+
+		$constants = [];
+
+		foreach ($this->constants as $constant) {
+			$current = is_array($constant) ? $constant : [$constant];
+
+			$constants = array_merge($constants, $current);
+		}
+
+		return array_merge($constants, $this->optional_constants);
+	}
+
+	/**
+	 * Adds the constants with their respective values into the wp-config.php.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $constant_values Key => Value of the necessary constants.
+	 * @return void
+	 */
+	public function setup_constants($constant_values): void {
+		/*
+		 * Important: This step is crucial, as it makes sure we clean up undesired constants.
+		 * Removing this can allow insertion of arbitrary constants onto the wp-config.pp file
+		 * and that should NEVER happen.
+		 *
+		 * Note that this is also performed on the get_constants_string.
+		 */
+		$values = shortcode_atts(array_flip($this->get_all_constants()), $constant_values);
+
+		foreach ($values as $constant => $value) {
+			WP_Config::get_instance()->inject_wp_config_constant($constant, $value);
+		}
+	}
+
+	/**
+	 * Generates a define string for manual insertion on-to wp-config.php.
+	 *
+	 * This is useful when the user is not willing to let Ultimate Multisite inject the code,
+	 * Or when the wp-config.php is not writable.
+	 *
+	 * @since 2.0.0
+	 *
+	 * @param array $constant_values Key => Value of the necessary constants.
+	 * @return string
+	 */
+	public function get_constants_string($constant_values) {
+		/*
+		 * Initializes the array with an opening comment.
+		 */
+		$content = [
+			sprintf('// Ultimate Multisite - Domain Mapping - %s', $this->get_title()),
+		];
+
+		/*
+		 * Important: This step is crucial, as it makes sure we clean up undesired constants.
+		 * Removing this can allow insertion of arbitrary constants onto the wp-config.php file
+		 * and that should NEVER happen.
+		 */
+		$constant_values = shortcode_atts(array_flip($this->get_all_constants()), $constant_values);
+
+		/*
+		 * Adds the constants, one by one.
+		 */
+		foreach ($constant_values as $constant => $value) {
+			$content[] = sprintf("define( '%s', '%s' );", $constant, $value);
+		}
+
+		/*
+		 * Adds the final line.
+		 */
+		$content[] = sprintf('// Ultimate Multisite - Domain Mapping - %s - End', $this->get_title());
+
+		return implode(PHP_EOL, $content);
+	}
+
+	/**
+	 * Returns the explainer lines for the integration.
+	 *
+	 * @since 2.0.0
+	 * @return array
+	 */
+	public function get_explainer_lines() {
+
+		$explainer_lines = [
+			'will'     => [
+				// translators: %s is the name of the integration e.g. RunCloud
+				'send_domains' => sprintf(__('Send API calls to %s servers with domain names added to this network', 'ultimate-multisite'), $this->get_title()),
+			],
+			'will_not' => [],
+		];
+
+		if ($this->supports('autossl')) {
+
+			// translators: %s is the name of the integration e.g. RunCloud
+			$explainer_lines['will'][] = sprintf(__('Fetch and install a SSL certificate on %s platform after the domain is added.', 'ultimate-multisite'), $this->get_title());
+		} else {
+
+			// translators: %s is the name of the integration e.g. RunCloud
+			$explainer_lines['will_not'][] = sprintf(__('Fetch and install a SSL certificate on %s platform after the domain is added. This needs to be done manually.', 'ultimate-multisite'), $this->get_title());
+		}
+
+		return $explainer_lines;
+	}
+
+	/**
+	 * This method gets called when a new domain is mapped.
+	 *
+	 * @since 2.0.0
+	 * @param string $domain The domain name being mapped.
+	 * @param int    $site_id ID of the site that is receiving that mapping.
+	 * @return void
+	 */
+	abstract public function on_add_domain($domain, $site_id);
+
+	/**
+	 * This method gets called when a mapped domain is removed.
+	 *
+	 * @since 2.0.0
+	 * @param string $domain The domain name being removed.
+	 * @param int    $site_id ID of the site that is receiving that mapping.
+	 * @return void
+	 */
+	abstract public function on_remove_domain($domain, $site_id);
+
+	/**
+	 * This method gets called when a new subdomain is being added.
+	 *
+	 * This happens every time a new site is added to a network running on subdomain mode.
+	 *
+	 * @since 2.0.0
+	 * @param string $subdomain The subdomain being added to the network.
+	 * @param int    $site_id ID of the site that is receiving that mapping.
+	 * @return void
+	 */
+	abstract public function on_add_subdomain($subdomain, $site_id);
+
+	/**
+	 * This method gets called when a new subdomain is being removed.
+	 *
+	 * This happens every time a new site is removed to a network running on subdomain mode.
+	 *
+	 * @since 2.0.0
+	 * @param string $subdomain The subdomain being removed to the network.
+	 * @param int    $site_id ID of the site that is receiving that mapping.
+	 * @return void
+	 */
+	abstract public function on_remove_subdomain($subdomain, $site_id);
+
+	/**
+	 * Tests the connection with the API.
+	 *
+	 * Needs to be implemented by integrations.
+	 *
+	 * @since 2.0.0
+	 * @return void
+	 */
+	public function test_connection(): void {
+
+		wp_send_json_success([]);
+	}
+
+	/**
+	 * Returns the description of this integration.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	public function get_description() {
+
+		return __('No description provided.', 'ultimate-multisite');
+	}
+
+	/**
+	 * Returns the logo for the integration.
+	 *
+	 * @since 2.0.0
+	 * @return string
+	 */
+	public function get_logo() {
+
+		return '';
+	}
+}
diff --git a/inc/integrations/providers/closte/class-closte-integration.php b/inc/integrations/providers/closte/class-closte-integration.php
index adcf8369e..3fa81b821 100644
--- a/inc/integrations/providers/closte/class-closte-integration.php
+++ b/inc/integrations/providers/closte/class-closte-integration.php
@@ -41,13 +41,20 @@ public function __construct() {
 
 		parent::__construct('closte', 'Closte');
 
-		$this->set_description(__('Closte serverless hosting integration with automatic domain mapping and SSL.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('closte.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/closte');
 		$this->set_constants(['CLOSTE_CLIENT_API_KEY']);
 		$this->set_supports(['autossl', 'no-instructions', 'no-config']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Closte serverless hosting integration with automatic domain mapping and SSL.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/cloudflare/class-cloudflare-integration.php b/inc/integrations/providers/cloudflare/class-cloudflare-integration.php
index 5f52e8a35..15ffd038e 100644
--- a/inc/integrations/providers/cloudflare/class-cloudflare-integration.php
+++ b/inc/integrations/providers/cloudflare/class-cloudflare-integration.php
@@ -32,7 +32,6 @@ public function __construct() {
 
 		parent::__construct('cloudflare', 'Cloudflare');
 
-		$this->set_description(__('Cloudflare secures and ensures the reliability of your external-facing resources such as websites, APIs, and applications. It protects your internal resources such as behind-the-firewall applications, teams, and devices. And it is your platform for developing globally-scalable applications.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('cloudflare.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/cloudflare');
 		$this->set_constants(['WU_CLOUDFLARE_API_KEY', 'WU_CLOUDFLARE_ZONE_ID']);
@@ -40,6 +39,14 @@ public function __construct() {
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Cloudflare secures and ensures the reliability of your external-facing resources such as websites, APIs, and applications. It protects your internal resources such as behind-the-firewall applications, teams, and devices. And it is your platform for developing globally-scalable applications.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/cloudways/class-cloudways-integration.php b/inc/integrations/providers/cloudways/class-cloudways-integration.php
index 4078f4728..19bec97cc 100644
--- a/inc/integrations/providers/cloudways/class-cloudways-integration.php
+++ b/inc/integrations/providers/cloudways/class-cloudways-integration.php
@@ -29,7 +29,6 @@ public function __construct() {
 
 		parent::__construct('cloudways', 'Cloudways');
 
-		$this->set_description(__('Focus on your business and avoid all the web hosting hassles. Our managed hosting guarantees unmatched performance, reliability and choice with 24/7 support that acts as your extended team, making Cloudways an ultimate choice for growing agencies and e-commerce businesses.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('cloudways.webp', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/cloudways');
 		$this->set_constants(
@@ -44,6 +43,14 @@ public function __construct() {
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Focus on your business and avoid all the web hosting hassles. Our managed hosting guarantees unmatched performance, reliability and choice with 24/7 support that acts as your extended team, making Cloudways an ultimate choice for growing agencies and e-commerce businesses.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/cpanel/class-cpanel-integration.php b/inc/integrations/providers/cpanel/class-cpanel-integration.php
index 301734d51..d14de88b3 100644
--- a/inc/integrations/providers/cpanel/class-cpanel-integration.php
+++ b/inc/integrations/providers/cpanel/class-cpanel-integration.php
@@ -42,7 +42,6 @@ public function __construct() {
 
 		parent::__construct('cpanel', 'cPanel');
 
-		$this->set_description(__('cPanel is the management panel being used on a large number of shared and dedicated hosts across the globe.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('cpanel.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/cpanel');
 		$this->set_constants(
@@ -56,6 +55,14 @@ public function __construct() {
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('cPanel is the management panel being used on a large number of shared and dedicated hosts across the globe.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/enhance/class-enhance-integration.php b/inc/integrations/providers/enhance/class-enhance-integration.php
index f25413db6..2da235e7c 100644
--- a/inc/integrations/providers/enhance/class-enhance-integration.php
+++ b/inc/integrations/providers/enhance/class-enhance-integration.php
@@ -29,7 +29,6 @@ public function __construct() {
 
 		parent::__construct('enhance', 'Enhance Control Panel');
 
-		$this->set_description(__('Enhance is a modern control panel that provides powerful hosting automation and management capabilities.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('enhance.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/enhance');
 		$this->set_constants(
@@ -43,6 +42,14 @@ public function __construct() {
 		$this->set_supports(['autossl', 'no-instructions']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Enhance is a modern control panel that provides powerful hosting automation and management capabilities.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/gridpane/class-gridpane-integration.php b/inc/integrations/providers/gridpane/class-gridpane-integration.php
index 45e8d618a..35b750a2f 100644
--- a/inc/integrations/providers/gridpane/class-gridpane-integration.php
+++ b/inc/integrations/providers/gridpane/class-gridpane-integration.php
@@ -32,13 +32,20 @@ public function __construct() {
 
 		parent::__construct('gridpane', 'Gridpane');
 
-		$this->set_description(__("GridPane is the world's first hosting control panel built exclusively for serious WordPress professionals.", 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('gridpane.webp', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/gridpane');
 		$this->set_constants(['WU_GRIDPANE', 'WU_GRIDPANE_API_KEY', 'WU_GRIDPANE_APP_ID', 'WU_GRIDPANE_SERVER_ID']);
 		$this->set_supports(['autossl', 'no-config']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __("GridPane is the world's first hosting control panel built exclusively for serious WordPress professionals.", 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/hestia/class-hestia-integration.php b/inc/integrations/providers/hestia/class-hestia-integration.php
index 11494275d..b10d43295 100644
--- a/inc/integrations/providers/hestia/class-hestia-integration.php
+++ b/inc/integrations/providers/hestia/class-hestia-integration.php
@@ -29,7 +29,6 @@ public function __construct() {
 
 		parent::__construct('hestia', 'Hestia Control Panel');
 
-		$this->set_description(__('Integrates with Hestia Control Panel to add and remove web domain aliases automatically when domains are mapped or removed.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('hestia.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/hestia');
 		$this->set_constants(
@@ -45,6 +44,14 @@ public function __construct() {
 		$this->set_supports(['no-instructions']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Integrates with Hestia Control Panel to add and remove web domain aliases automatically when domains are mapped or removed.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/plesk/class-plesk-integration.php b/inc/integrations/providers/plesk/class-plesk-integration.php
index 16d802c61..501ad2305 100644
--- a/inc/integrations/providers/plesk/class-plesk-integration.php
+++ b/inc/integrations/providers/plesk/class-plesk-integration.php
@@ -32,7 +32,6 @@ public function __construct() {
 
 		parent::__construct('plesk', 'Plesk');
 
-		$this->set_description(__('Integrates with Plesk to add and remove domain aliases automatically when domains are mapped or removed.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('plesk.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/plesk');
 		$this->set_constants(
@@ -46,6 +45,14 @@ public function __construct() {
 		$this->set_supports(['autossl', 'no-instructions']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Integrates with Plesk to add and remove domain aliases automatically when domains are mapped or removed.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/rocket/class-rocket-integration.php b/inc/integrations/providers/rocket/class-rocket-integration.php
index 750b93c68..e41257080 100644
--- a/inc/integrations/providers/rocket/class-rocket-integration.php
+++ b/inc/integrations/providers/rocket/class-rocket-integration.php
@@ -32,13 +32,20 @@ public function __construct() {
 
 		parent::__construct('rocket', 'Rocket.net');
 
-		$this->set_description(__('Rocket.net is a fully API-driven managed WordPress hosting platform built for speed, security, and scalability. With edge-first private cloud infrastructure and automatic SSL management, Rocket.net makes it easy to deploy and manage WordPress sites at scale.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('rocket.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/rocket');
 		$this->set_constants(['WU_ROCKET_EMAIL', 'WU_ROCKET_PASSWORD', 'WU_ROCKET_SITE_ID']);
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('Rocket.net is a fully API-driven managed WordPress hosting platform built for speed, security, and scalability. With edge-first private cloud infrastructure and automatic SSL management, Rocket.net makes it easy to deploy and manage WordPress sites at scale.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/runcloud/class-runcloud-integration.php b/inc/integrations/providers/runcloud/class-runcloud-integration.php
index 801023364..d88d9eef1 100644
--- a/inc/integrations/providers/runcloud/class-runcloud-integration.php
+++ b/inc/integrations/providers/runcloud/class-runcloud-integration.php
@@ -29,7 +29,6 @@ public function __construct() {
 
 		parent::__construct('runcloud', 'RunCloud');
 
-		$this->set_description(__('With RunCloud, you don\'t need to be a Linux expert to build a website powered by DigitalOcean, AWS, or Google Cloud. Use our graphical interface and build a business on the cloud affordably.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('runcloud.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/runcloud');
 		$this->set_constants(
@@ -42,6 +41,14 @@ public function __construct() {
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('With RunCloud, you don\'t need to be a Linux expert to build a website powered by DigitalOcean, AWS, or Google Cloud. Use our graphical interface and build a business on the cloud affordably.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/serverpilot/class-serverpilot-integration.php b/inc/integrations/providers/serverpilot/class-serverpilot-integration.php
index 71e24a3fc..e239e9c4b 100644
--- a/inc/integrations/providers/serverpilot/class-serverpilot-integration.php
+++ b/inc/integrations/providers/serverpilot/class-serverpilot-integration.php
@@ -33,13 +33,20 @@ public function __construct() {
 
 		parent::__construct('serverpilot', 'ServerPilot');
 
-		$this->set_description(__('ServerPilot is a cloud service for hosting WordPress and other PHP websites on servers at DigitalOcean, Amazon, Google, or any other server provider. You can think of ServerPilot as a modern, centralized hosting control panel.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('serverpilot.svg', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/serverpilot');
 		$this->set_constants(['WU_SERVER_PILOT_CLIENT_ID', 'WU_SERVER_PILOT_API_KEY', 'WU_SERVER_PILOT_APP_ID']);
 		$this->set_supports(['autossl']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('ServerPilot is a cloud service for hosting WordPress and other PHP websites on servers at DigitalOcean, Amazon, Google, or any other server provider. You can think of ServerPilot as a modern, centralized hosting control panel.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/integrations/providers/wpmudev/class-wpmudev-integration.php b/inc/integrations/providers/wpmudev/class-wpmudev-integration.php
index eeede1042..96e11f978 100644
--- a/inc/integrations/providers/wpmudev/class-wpmudev-integration.php
+++ b/inc/integrations/providers/wpmudev/class-wpmudev-integration.php
@@ -32,13 +32,20 @@ public function __construct() {
 
 		parent::__construct('wpmudev', 'WPMU DEV Hosting');
 
-		$this->set_description(__('WPMU DEV is one of the largest companies in the WordPress space. Founded in 2004, it was one of the first companies to scale the Website as a Service model with products such as Edublogs and CampusPress.', 'ultimate-multisite'));
 		$this->set_logo(function_exists('wu_get_asset') ? wu_get_asset('wpmudev.webp', 'img/hosts') : '');
 		$this->set_tutorial_link('https://ultimatemultisite.com/docs/user-guide/host-integrations/wpmu-dev');
 		$this->set_constants(['WPMUDEV_HOSTING_SITE_ID']);
 		$this->set_supports(['autossl', 'no-instructions', 'no-config']);
 	}
 
+	/**
+	 * {@inheritdoc}
+	 */
+	public function get_description(): string {
+
+		return __('WPMU DEV is one of the largest companies in the WordPress space. Founded in 2004, it was one of the first companies to scale the Website as a Service model with products such as Edublogs and CampusPress.', 'ultimate-multisite');
+	}
+
 	/**
 	 * {@inheritdoc}
 	 */
diff --git a/inc/list-tables/class-membership-list-table.php b/inc/list-tables/class-membership-list-table.php
index e78475ed3..8a8dcb456 100644
--- a/inc/list-tables/class-membership-list-table.php
+++ b/inc/list-tables/class-membership-list-table.php
@@ -187,7 +187,15 @@ public function get_columns() {
 			'id'              => __('ID', 'ultimate-multisite'),
 		];
 
-		return $columns;
+		/**
+		 * Filters the columns displayed in the memberships list table.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param array $columns The list table columns.
+		 * @return array
+		 */
+		return apply_filters('wu_memberships_list_table_columns', $columns);
 	}
 
 	/**
diff --git a/inc/list-tables/class-payment-list-table.php b/inc/list-tables/class-payment-list-table.php
index 58b4c6893..a74883485 100644
--- a/inc/list-tables/class-payment-list-table.php
+++ b/inc/list-tables/class-payment-list-table.php
@@ -201,7 +201,15 @@ public function get_columns() {
 			'id'           => __('ID', 'ultimate-multisite'),
 		];
 
-		return $columns;
+		/**
+		 * Filters the columns displayed in the payments list table.
+		 *
+		 * @since 2.3.0
+		 *
+		 * @param array $columns The list table columns.
+		 * @return array
+		 */
+		return apply_filters('wu_payments_list_table_columns', $columns);
 	}
 
 	/**
diff --git a/inc/managers/class-gateway-manager.php b/inc/managers/class-gateway-manager.php
index 899200149..79a87d118 100644
--- a/inc/managers/class-gateway-manager.php
+++ b/inc/managers/class-gateway-manager.php
@@ -19,6 +19,8 @@
 use WP_Ultimo\Gateways\Stripe_Gateway;
 use WP_Ultimo\Gateways\Stripe_Checkout_Gateway;
 use WP_Ultimo\Gateways\PayPal_Gateway;
+use WP_Ultimo\Gateways\PayPal_REST_Gateway;
+use WP_Ultimo\Gateways\PayPal_Webhook_Handler;
 use WP_Ultimo\Gateways\Manual_Gateway;
 
 // Exit if accessed directly
@@ -428,10 +430,27 @@ public function add_default_gateways(): void {
 		wu_register_gateway('stripe-checkout', __('Stripe Checkout', 'ultimate-multisite'), $stripe_checkout_desc, Stripe_Checkout_Gateway::class);
 
 		/*
-		 * PayPal Payments
+		 * PayPal Payments (REST API - Modern)
 		 */
-		$paypal_desc = __('PayPal is the leading provider in checkout solutions and it is the easier way to get your network subscriptions going.', 'ultimate-multisite');
-		wu_register_gateway('paypal', __('PayPal', 'ultimate-multisite'), $paypal_desc, PayPal_Gateway::class);
+		$paypal_rest_desc = __('Modern PayPal integration with Connect with PayPal onboarding. Recommended for new setups.', 'ultimate-multisite');
+		wu_register_gateway('paypal-rest', __('PayPal', 'ultimate-multisite'), $paypal_rest_desc, PayPal_REST_Gateway::class);
+
+		/*
+		 * PayPal Payments (Legacy NVP API)
+		 * Only show if already active or has existing credentials configured.
+		 */
+		$legacy_paypal_active    = in_array('paypal', (array) wu_get_setting('active_gateways', []), true);
+		$legacy_paypal_has_creds = wu_get_setting('paypal_test_username', '') || wu_get_setting('paypal_live_username', '');
+
+		if ($legacy_paypal_active || $legacy_paypal_has_creds) {
+			$paypal_desc = __('PayPal Express Checkout (Legacy). Uses username/password/signature authentication. For existing integrations only.', 'ultimate-multisite');
+			wu_register_gateway('paypal', __('PayPal (Legacy)', 'ultimate-multisite'), $paypal_desc, PayPal_Gateway::class);
+		}
+
+		/*
+		 * Initialize PayPal REST webhook handler
+		 */
+		PayPal_Webhook_Handler::get_instance()->init();
 
 		/*
 		 * Manual Payments
@@ -543,11 +562,11 @@ public function install_hooks($class_name): void {
 
 		add_action("wu_{$gateway_id}_process_webhooks", [$gateway, 'process_webhooks']);
 
-		add_action("wu_{$gateway_id}_remote_payment_url", [$gateway, 'get_payment_url_on_gateway']); // @phpstan-ignore-line Used as filter via apply_filters.
+		add_filter("wu_{$gateway_id}_remote_payment_url", [$gateway, 'get_payment_url_on_gateway']);
 
-		add_action("wu_{$gateway_id}_remote_subscription_url", [$gateway, 'get_subscription_url_on_gateway']);
+		add_filter("wu_{$gateway_id}_remote_subscription_url", [$gateway, 'get_subscription_url_on_gateway']);
 
-		add_action("wu_{$gateway_id}_remote_customer_url", [$gateway, 'get_customer_url_on_gateway']);
+		add_filter("wu_{$gateway_id}_remote_customer_url", [$gateway, 'get_customer_url_on_gateway']);
 
 		/*
 		 * Renders the gateway fields.
@@ -556,7 +575,7 @@ public function install_hooks($class_name): void {
 			'wu_checkout_gateway_fields',
 			function () use ($gateway) {
 
-				$field_content = call_user_func([$gateway, 'fields']); // @phpstan-ignore-line Subclass implementations return string.
+				$field_content = $gateway->fields();
 
 				ob_start();
 
diff --git a/inc/models/class-membership.php b/inc/models/class-membership.php
index 43b6fdba2..666001ac2 100644
--- a/inc/models/class-membership.php
+++ b/inc/models/class-membership.php
@@ -969,7 +969,10 @@ public function get_price_description(): string {
 	 */
 	public function get_currency() {
 
-		// return $this->currency; For now, multi-currency is not yet supported.
+		if (! empty($this->currency)) {
+			return $this->currency;
+		}
+
 		return wu_get_setting('currency_symbol', 'USD');
 	}
 
diff --git a/inc/models/class-payment.php b/inc/models/class-payment.php
index 48af84f9b..447442ea8 100644
--- a/inc/models/class-payment.php
+++ b/inc/models/class-payment.php
@@ -354,8 +354,11 @@ public function set_parent_id($parent_id): void {
 	 */
 	public function get_currency(): string {
 
-		// return $this->currency; For now, multi-currency is not yet supported.
-		return wu_get_setting('currency_symbol', 'USD');
+		if (! empty($this->currency)) {
+			return $this->currency;
+		}
+
+		return wu_get_setting('currency', 'USD');
 	}
 
 	/**
diff --git a/tests/WP_Ultimo/Gateways/PayPal_OAuth_Handler_Test.php b/tests/WP_Ultimo/Gateways/PayPal_OAuth_Handler_Test.php
new file mode 100644
index 000000000..a2e1ff23d
--- /dev/null
+++ b/tests/WP_Ultimo/Gateways/PayPal_OAuth_Handler_Test.php
@@ -0,0 +1,209 @@
+<?php
+/**
+ * Tests for PayPal OAuth Handler.
+ *
+ * @package WP_Ultimo
+ * @subpackage Tests
+ * @since 2.x.x
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use WP_UnitTestCase;
+
+/**
+ * PayPal OAuth Handler Test class.
+ */
+class PayPal_OAuth_Handler_Test extends WP_UnitTestCase {
+
+	/**
+	 * Test handler instance.
+	 *
+	 * @var PayPal_OAuth_Handler
+	 */
+	protected $handler;
+
+	/**
+	 * Setup test.
+	 */
+	public function setUp(): void {
+		parent::setUp();
+
+		// Clear all PayPal REST settings
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+		wu_save_setting('paypal_rest_sandbox_merchant_id', '');
+		wu_save_setting('paypal_rest_sandbox_merchant_email', '');
+		wu_save_setting('paypal_rest_live_merchant_id', '');
+		wu_save_setting('paypal_rest_live_merchant_email', '');
+		wu_save_setting('paypal_rest_connection_date', '');
+
+		$this->handler = PayPal_OAuth_Handler::get_instance();
+	}
+
+	/**
+	 * Test handler is singleton.
+	 */
+	public function test_singleton(): void {
+
+		$instance1 = PayPal_OAuth_Handler::get_instance();
+		$instance2 = PayPal_OAuth_Handler::get_instance();
+
+		$this->assertSame($instance1, $instance2);
+	}
+
+	/**
+	 * Test is_configured returns true (proxy URL is always set).
+	 */
+	public function test_is_configured(): void {
+
+		$this->assertTrue($this->handler->is_configured());
+	}
+
+	/**
+	 * Test is_configured returns false when proxy URL is empty.
+	 */
+	public function test_is_configured_false_without_proxy(): void {
+
+		add_filter('wu_paypal_connect_proxy_url', '__return_empty_string');
+
+		$this->assertFalse($this->handler->is_configured());
+
+		remove_filter('wu_paypal_connect_proxy_url', '__return_empty_string');
+	}
+
+	/**
+	 * Test merchant not connected without merchant ID.
+	 */
+	public function test_merchant_not_connected_without_id(): void {
+
+		$this->assertFalse($this->handler->is_merchant_connected(true));
+		$this->assertFalse($this->handler->is_merchant_connected(false));
+	}
+
+	/**
+	 * Test merchant connected in sandbox mode.
+	 */
+	public function test_merchant_connected_sandbox(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'SANDBOX_MERCHANT_123');
+
+		$this->assertTrue($this->handler->is_merchant_connected(true));
+		$this->assertFalse($this->handler->is_merchant_connected(false));
+	}
+
+	/**
+	 * Test merchant connected in live mode.
+	 */
+	public function test_merchant_connected_live(): void {
+
+		wu_save_setting('paypal_rest_live_merchant_id', 'LIVE_MERCHANT_456');
+
+		$this->assertFalse($this->handler->is_merchant_connected(true));
+		$this->assertTrue($this->handler->is_merchant_connected(false));
+	}
+
+	/**
+	 * Test get_merchant_details returns correct sandbox data.
+	 */
+	public function test_get_merchant_details_sandbox(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'MERCHANT_ID_TEST');
+		wu_save_setting('paypal_rest_sandbox_merchant_email', 'test@merchant.com');
+		wu_save_setting('paypal_rest_sandbox_payments_receivable', true);
+		wu_save_setting('paypal_rest_sandbox_email_confirmed', true);
+		wu_save_setting('paypal_rest_connection_date', '2026-02-01 10:00:00');
+
+		$details = $this->handler->get_merchant_details(true);
+
+		$this->assertEquals('MERCHANT_ID_TEST', $details['merchant_id']);
+		$this->assertEquals('test@merchant.com', $details['merchant_email']);
+		$this->assertTrue($details['payments_receivable']);
+		$this->assertTrue($details['email_confirmed']);
+		$this->assertEquals('2026-02-01 10:00:00', $details['connection_date']);
+	}
+
+	/**
+	 * Test get_merchant_details returns correct live data.
+	 */
+	public function test_get_merchant_details_live(): void {
+
+		wu_save_setting('paypal_rest_live_merchant_id', 'LIVE_MID');
+		wu_save_setting('paypal_rest_live_merchant_email', 'live@merchant.com');
+
+		$details = $this->handler->get_merchant_details(false);
+
+		$this->assertEquals('LIVE_MID', $details['merchant_id']);
+		$this->assertEquals('live@merchant.com', $details['merchant_email']);
+	}
+
+	/**
+	 * Test get_merchant_details returns empty defaults when not connected.
+	 */
+	public function test_get_merchant_details_empty(): void {
+
+		$details = $this->handler->get_merchant_details(true);
+
+		$this->assertEmpty($details['merchant_id']);
+		$this->assertEmpty($details['merchant_email']);
+		$this->assertEmpty($details['connection_date']);
+	}
+
+	/**
+	 * Test init registers AJAX hooks.
+	 */
+	public function test_init_registers_hooks(): void {
+
+		$this->handler->init();
+
+		$this->assertNotFalse(has_action('wp_ajax_wu_paypal_connect', [$this->handler, 'ajax_initiate_oauth']));
+		$this->assertNotFalse(has_action('wp_ajax_wu_paypal_disconnect', [$this->handler, 'ajax_disconnect']));
+		$this->assertNotFalse(has_action('admin_init', [$this->handler, 'handle_oauth_return']));
+	}
+
+	/**
+	 * Test is_oauth_feature_enabled defaults to false (proxy unreachable in tests).
+	 */
+	public function test_oauth_feature_disabled_by_default(): void {
+
+		// Clear any cached transient
+		delete_site_transient('wu_paypal_oauth_enabled');
+
+		// In test environment the proxy is unreachable, so it should be false
+		// We use a filter override to avoid the actual HTTP call
+		add_filter('wu_paypal_oauth_enabled', '__return_false');
+
+		$this->assertFalse($this->handler->is_oauth_feature_enabled());
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_false');
+	}
+
+	/**
+	 * Test is_oauth_feature_enabled returns true with filter override.
+	 */
+	public function test_oauth_feature_enabled_via_filter(): void {
+
+		add_filter('wu_paypal_oauth_enabled', '__return_true');
+
+		$this->assertTrue($this->handler->is_oauth_feature_enabled());
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_true');
+	}
+
+	/**
+	 * Test is_oauth_feature_enabled respects cached transient.
+	 */
+	public function test_oauth_feature_uses_transient_cache(): void {
+
+		// Set the transient directly
+		set_site_transient('wu_paypal_oauth_enabled', 'yes', HOUR_IN_SECONDS);
+
+		$this->assertTrue($this->handler->is_oauth_feature_enabled());
+
+		set_site_transient('wu_paypal_oauth_enabled', 'no', HOUR_IN_SECONDS);
+
+		$this->assertFalse($this->handler->is_oauth_feature_enabled());
+
+		// Cleanup
+		delete_site_transient('wu_paypal_oauth_enabled');
+	}
+}
diff --git a/tests/WP_Ultimo/Gateways/PayPal_REST_Gateway_Test.php b/tests/WP_Ultimo/Gateways/PayPal_REST_Gateway_Test.php
new file mode 100644
index 000000000..926ea72eb
--- /dev/null
+++ b/tests/WP_Ultimo/Gateways/PayPal_REST_Gateway_Test.php
@@ -0,0 +1,622 @@
+<?php
+/**
+ * Tests for PayPal REST Gateway.
+ *
+ * @package WP_Ultimo
+ * @subpackage Tests
+ * @since 2.x.x
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use WP_UnitTestCase;
+
+/**
+ * PayPal REST Gateway Test class.
+ */
+class PayPal_REST_Gateway_Test extends WP_UnitTestCase {
+
+	/**
+	 * Test gateway instance.
+	 *
+	 * @var PayPal_REST_Gateway
+	 */
+	protected $gateway;
+
+	/**
+	 * Setup test.
+	 */
+	public function setUp(): void {
+		parent::setUp();
+
+		// Clear all PayPal REST settings before each test
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+		wu_save_setting('paypal_rest_sandbox_client_id', '');
+		wu_save_setting('paypal_rest_sandbox_client_secret', '');
+		wu_save_setting('paypal_rest_sandbox_merchant_id', '');
+		wu_save_setting('paypal_rest_live_client_id', '');
+		wu_save_setting('paypal_rest_live_client_secret', '');
+		wu_save_setting('paypal_rest_live_merchant_id', '');
+		wu_save_setting('paypal_rest_connected', false);
+		wu_save_setting('paypal_rest_sandbox_webhook_id', '');
+		wu_save_setting('paypal_rest_live_webhook_id', '');
+
+		$this->gateway = new PayPal_REST_Gateway();
+	}
+
+	/**
+	 * Test gateway ID.
+	 */
+	public function test_gateway_id(): void {
+
+		$this->assertEquals('paypal-rest', $this->gateway->get_id());
+	}
+
+	/**
+	 * Test gateway supports recurring.
+	 */
+	public function test_supports_recurring(): void {
+
+		$this->assertTrue($this->gateway->supports_recurring());
+	}
+
+	/**
+	 * Test gateway supports amount update.
+	 */
+	public function test_supports_amount_update(): void {
+
+		$this->assertTrue($this->gateway->supports_amount_update());
+	}
+
+	/**
+	 * Test not configured when no credentials.
+	 */
+	public function test_not_configured_without_credentials(): void {
+
+		$this->gateway->init();
+		$this->assertFalse($this->gateway->is_configured());
+	}
+
+	/**
+	 * Test configured with manual client credentials.
+	 */
+	public function test_configured_with_manual_credentials(): void {
+
+		wu_save_setting('paypal_rest_sandbox_client_id', 'test_client_id_123');
+		wu_save_setting('paypal_rest_sandbox_client_secret', 'test_client_secret_456');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		$this->assertTrue($gateway->is_configured());
+	}
+
+	/**
+	 * Test configured with OAuth merchant ID.
+	 */
+	public function test_configured_with_oauth_merchant_id(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'MERCHANT123');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		$this->assertTrue($gateway->is_configured());
+	}
+
+	/**
+	 * Test connection status when not connected.
+	 */
+	public function test_connection_status_not_connected(): void {
+
+		$this->gateway->init();
+		$status = $this->gateway->get_connection_status();
+
+		$this->assertFalse($status['connected']);
+		$this->assertArrayHasKey('message', $status);
+		$this->assertArrayHasKey('details', $status);
+	}
+
+	/**
+	 * Test connection status with manual credentials.
+	 */
+	public function test_connection_status_with_manual_credentials(): void {
+
+		wu_save_setting('paypal_rest_sandbox_client_id', 'test_client_id_123');
+		wu_save_setting('paypal_rest_sandbox_client_secret', 'test_client_secret_456');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+		$status = $gateway->get_connection_status();
+
+		$this->assertTrue($status['connected']);
+		$this->assertEquals('manual', $status['details']['method']);
+		$this->assertEquals('sandbox', $status['details']['mode']);
+	}
+
+	/**
+	 * Test connection status with OAuth merchant.
+	 */
+	public function test_connection_status_with_oauth(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'MERCHANT123');
+		wu_save_setting('paypal_rest_sandbox_merchant_email', 'merchant@example.com');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+		wu_save_setting('paypal_rest_connection_date', '2026-01-01 00:00:00');
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+		$status = $gateway->get_connection_status();
+
+		$this->assertTrue($status['connected']);
+		$this->assertEquals('oauth', $status['details']['method']);
+		$this->assertEquals('MERCHANT123', $status['details']['merchant_id']);
+	}
+
+	/**
+	 * Test set_test_mode switches credentials.
+	 */
+	public function test_set_test_mode(): void {
+
+		wu_save_setting('paypal_rest_sandbox_client_id', 'sandbox_id');
+		wu_save_setting('paypal_rest_sandbox_client_secret', 'sandbox_secret');
+		wu_save_setting('paypal_rest_live_client_id', 'live_id');
+		wu_save_setting('paypal_rest_live_client_secret', 'live_secret');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		// Verify sandbox mode credentials
+		$reflection = new \ReflectionClass($gateway);
+		$prop       = $reflection->getProperty('client_id');
+
+		$this->assertEquals('sandbox_id', $prop->getValue($gateway));
+
+		// Switch to live mode
+		$gateway->set_test_mode(false);
+
+		$this->assertEquals('live_id', $prop->getValue($gateway));
+	}
+
+	/**
+	 * Test payment URL generation.
+	 */
+	public function test_payment_url_on_gateway(): void {
+
+		$this->gateway->init();
+
+		$url = $this->gateway->get_payment_url_on_gateway('PAY-123');
+		$this->assertStringContainsString('sandbox.paypal.com', $url);
+		$this->assertStringContainsString('PAY-123', $url);
+	}
+
+	/**
+	 * Test payment URL empty for empty ID.
+	 */
+	public function test_payment_url_empty_for_empty_id(): void {
+
+		$this->gateway->init();
+
+		$url = $this->gateway->get_payment_url_on_gateway('');
+		$this->assertEmpty($url);
+	}
+
+	/**
+	 * Test subscription URL for REST API subscription.
+	 */
+	public function test_subscription_url_rest_api(): void {
+
+		$this->gateway->init();
+
+		$url = $this->gateway->get_subscription_url_on_gateway('I-SUBSCRIPTION123');
+		$this->assertStringContainsString('sandbox.paypal.com', $url);
+		$this->assertStringContainsString('billing/subscriptions', $url);
+		$this->assertStringContainsString('I-SUBSCRIPTION123', $url);
+	}
+
+	/**
+	 * Test subscription URL for legacy NVP profile.
+	 */
+	public function test_subscription_url_legacy_nvp(): void {
+
+		$this->gateway->init();
+
+		$url = $this->gateway->get_subscription_url_on_gateway('LEGACY-PROFILE-123');
+		$this->assertStringContainsString('sandbox.paypal.com', $url);
+		$this->assertStringContainsString('_profile-recurring-payments', $url);
+	}
+
+	/**
+	 * Test subscription URL empty for empty ID.
+	 */
+	public function test_subscription_url_empty_for_empty_id(): void {
+
+		$this->gateway->init();
+
+		$url = $this->gateway->get_subscription_url_on_gateway('');
+		$this->assertEmpty($url);
+	}
+
+	/**
+	 * Test live mode URLs.
+	 */
+	public function test_live_mode_urls(): void {
+
+		wu_save_setting('paypal_rest_sandbox_mode', 0);
+		wu_save_setting('paypal_rest_live_client_id', 'live_id');
+		wu_save_setting('paypal_rest_live_client_secret', 'live_secret');
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		$url = $gateway->get_payment_url_on_gateway('PAY-123');
+		$this->assertStringContainsString('www.paypal.com', $url);
+		$this->assertStringNotContainsString('sandbox', $url);
+	}
+
+	/**
+	 * Test other_ids includes both paypal and paypal-rest.
+	 */
+	public function test_other_ids(): void {
+
+		$all_ids = $this->gateway->get_all_ids();
+
+		$this->assertContains('paypal-rest', $all_ids);
+		$this->assertContains('paypal', $all_ids);
+	}
+
+	/**
+	 * Test API base URL in sandbox mode.
+	 */
+	public function test_api_base_url_sandbox(): void {
+
+		$this->gateway->init();
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('get_api_base_url');
+
+		$url = $method->invoke($this->gateway);
+		$this->assertEquals('https://api-m.sandbox.paypal.com', $url);
+	}
+
+	/**
+	 * Test API base URL in live mode.
+	 */
+	public function test_api_base_url_live(): void {
+
+		$this->gateway->set_test_mode(false);
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('get_api_base_url');
+
+		$url = $method->invoke($this->gateway);
+		$this->assertEquals('https://api-m.paypal.com', $url);
+	}
+
+	/**
+	 * Test access token error without credentials.
+	 */
+	public function test_access_token_error_without_credentials(): void {
+
+		$this->gateway->init();
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('get_access_token');
+
+		$result = $method->invoke($this->gateway);
+		$this->assertInstanceOf(\WP_Error::class, $result);
+		$this->assertEquals('wu_paypal_missing_credentials', $result->get_error_code());
+	}
+
+	/**
+	 * Test platform fee not applied without OAuth merchant ID.
+	 */
+	public function test_platform_fee_not_applied_without_oauth(): void {
+
+		wu_save_setting('paypal_rest_sandbox_client_id', 'test_client_id');
+		wu_save_setting('paypal_rest_sandbox_client_secret', 'test_secret');
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		$this->assertFalse($gateway->should_apply_platform_fee());
+	}
+
+	/**
+	 * Test platform fee applied with OAuth merchant ID and no addon purchase.
+	 */
+	public function test_platform_fee_applied_with_oauth(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'MERCHANT123');
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		// Fee should apply when OAuth connected and no addon purchased
+		// (has_addon_purchase returns false by default in test)
+		$this->assertTrue($gateway->should_apply_platform_fee());
+	}
+
+	/**
+	 * Test platform fee percentage.
+	 */
+	public function test_platform_fee_percent(): void {
+
+		$this->assertEquals(3.0, $this->gateway->get_platform_fee_percent());
+	}
+
+	/**
+	 * Test PayPal-Auth-Assertion JWT format.
+	 */
+	public function test_build_auth_assertion(): void {
+
+		$this->gateway->init();
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('build_auth_assertion');
+
+		$assertion = $method->invoke($this->gateway, 'PARTNER_CLIENT_ID', 'MERCHANT_PAYER_ID');
+
+		// Should be base64(header).base64(payload).
+		$parts = explode('.', $assertion);
+		$this->assertCount(3, $parts);
+		$this->assertEquals('', $parts[2]); // Empty signature
+
+		// Decode header
+		$header = json_decode(base64_decode($parts[0]), true); // phpcs:ignore
+		$this->assertEquals('none', $header['alg']);
+
+		// Decode payload
+		$payload = json_decode(base64_decode($parts[1]), true); // phpcs:ignore
+		$this->assertEquals('PARTNER_CLIENT_ID', $payload['iss']);
+		$this->assertEquals('MERCHANT_PAYER_ID', $payload['payer_id']);
+	}
+
+	/**
+	 * Test get_partner_data returns error when proxy unavailable.
+	 */
+	public function test_get_partner_data_error_on_proxy_failure(): void {
+
+		$this->gateway->init();
+
+		// Override proxy URL to a non-existent server
+		add_filter(
+			'wu_paypal_connect_proxy_url',
+			function () {
+				return 'https://nonexistent-proxy.test/wp-json/paypal-connect/v1';
+			}
+		);
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('get_partner_data');
+
+		$result = $method->invoke($this->gateway);
+		$this->assertInstanceOf(\WP_Error::class, $result);
+	}
+
+	/**
+	 * Test settings registers fields without OAuth feature flag.
+	 *
+	 * When OAuth is disabled (default), manual keys are shown directly
+	 * without the advanced toggle or OAuth connection field.
+	 */
+	public function test_settings_registers_fields_without_oauth(): void {
+
+		$this->gateway->init();
+
+		// Ensure OAuth feature flag is off (default state)
+		add_filter('wu_paypal_oauth_enabled', '__return_false');
+
+		$this->gateway->settings();
+
+		$fields    = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+		$field_ids = array_keys($fields);
+
+		// Core fields always present
+		$this->assertContains('paypal_rest_header', $field_ids);
+		$this->assertContains('paypal_rest_sandbox_mode', $field_ids);
+		$this->assertContains('paypal_rest_sandbox_client_id', $field_ids);
+		$this->assertContains('paypal_rest_webhook_url', $field_ids);
+
+		// OAuth fields should NOT be present
+		$this->assertNotContains('paypal_rest_oauth_connection', $field_ids);
+		$this->assertNotContains('paypal_rest_show_manual_keys', $field_ids);
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_false');
+	}
+
+	/**
+	 * Test settings registers OAuth fields when feature flag is on.
+	 */
+	public function test_settings_registers_oauth_fields_when_enabled(): void {
+
+		$this->gateway->init();
+
+		add_filter('wu_paypal_oauth_enabled', '__return_true');
+
+		$this->gateway->settings();
+
+		$fields    = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+		$field_ids = array_keys($fields);
+
+		$this->assertContains('paypal_rest_oauth_connection', $field_ids);
+		$this->assertContains('paypal_rest_show_manual_keys', $field_ids);
+		$this->assertContains('paypal_rest_sandbox_client_id', $field_ids);
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_true');
+	}
+
+	/**
+	 * Test settings fields require active gateway.
+	 */
+	public function test_settings_fields_require_active_gateway(): void {
+
+		$this->gateway->init();
+		$this->gateway->settings();
+
+		$fields = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+
+		// All PayPal REST fields should require the gateway to be active
+		foreach ($fields as $field_id => $field) {
+			if (strpos($field_id, 'paypal_rest_') === 0) {
+				$this->assertArrayHasKey('require', $field, "Field $field_id should have require key");
+				$this->assertEquals('paypal-rest', $field['require']['active_gateways'] ?? '', "Field $field_id should require paypal-rest gateway");
+			}
+		}
+	}
+
+	/**
+	 * Test manual keys shown directly when OAuth is disabled.
+	 */
+	public function test_manual_fields_shown_directly_without_oauth(): void {
+
+		$this->gateway->init();
+
+		add_filter('wu_paypal_oauth_enabled', '__return_false');
+
+		$this->gateway->settings();
+
+		$fields = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+
+		// Manual key fields should NOT require the show_manual_keys toggle
+		$this->assertArrayHasKey('paypal_rest_sandbox_client_id', $fields);
+		$this->assertArrayNotHasKey(
+			'paypal_rest_show_manual_keys',
+			$fields['paypal_rest_sandbox_client_id']['require'],
+			'Manual keys should be shown directly when OAuth is disabled'
+		);
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_false');
+	}
+
+	/**
+	 * Test manual fields require toggle when OAuth is enabled.
+	 */
+	public function test_manual_fields_require_toggle_with_oauth(): void {
+
+		$this->gateway->init();
+
+		add_filter('wu_paypal_oauth_enabled', '__return_true');
+
+		$this->gateway->settings();
+
+		$fields = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+
+		$this->assertArrayHasKey('paypal_rest_sandbox_client_id', $fields);
+		$this->assertEquals(
+			1,
+			$fields['paypal_rest_sandbox_client_id']['require']['paypal_rest_show_manual_keys'] ?? null,
+			'Manual keys should require toggle when OAuth is enabled'
+		);
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_true');
+	}
+
+	/**
+	 * Test OAuth connection field uses html type with content callback.
+	 */
+	public function test_oauth_connection_field_type(): void {
+
+		$this->gateway->init();
+
+		add_filter('wu_paypal_oauth_enabled', '__return_true');
+
+		$this->gateway->settings();
+
+		$fields = apply_filters('wu_settings_section_payment-gateways_fields', []); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
+
+		$this->assertArrayHasKey('paypal_rest_oauth_connection', $fields);
+		$this->assertEquals('html', $fields['paypal_rest_oauth_connection']['type']);
+		$this->assertIsCallable($fields['paypal_rest_oauth_connection']['content']);
+
+		remove_filter('wu_paypal_oauth_enabled', '__return_true');
+	}
+
+	/**
+	 * Test render_oauth_connection outputs disconnected state.
+	 */
+	public function test_render_oauth_connection_disconnected(): void {
+
+		$this->gateway->init();
+
+		ob_start();
+		$this->gateway->render_oauth_connection();
+		$output = ob_get_clean();
+
+		// Should show the disconnected/manual keys prompt since no proxy configured in test
+		$this->assertStringContainsString('wu-oauth-status', $output);
+		$this->assertStringContainsString('wu-disconnected', $output);
+	}
+
+	/**
+	 * Test render_oauth_connection outputs connected state with merchant ID.
+	 */
+	public function test_render_oauth_connection_connected(): void {
+
+		wu_save_setting('paypal_rest_sandbox_merchant_id', 'TESTMERCHANT456');
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$gateway = new PayPal_REST_Gateway();
+		$gateway->init();
+
+		ob_start();
+		$gateway->render_oauth_connection();
+		$output = ob_get_clean();
+
+		$this->assertStringContainsString('wu-connected', $output);
+		$this->assertStringContainsString('TESTMERCHANT456', $output);
+		$this->assertStringContainsString('wu-paypal-disconnect', $output);
+	}
+
+	/**
+	 * Test render_oauth_connection includes fee notice.
+	 */
+	public function test_render_oauth_connection_fee_notice(): void {
+
+		$this->gateway->init();
+
+		ob_start();
+		$this->gateway->render_oauth_connection();
+		$output = ob_get_clean();
+
+		// Fee notice should be present (unless addon is purchased)
+		$this->assertStringContainsString('fee', strtolower($output));
+	}
+
+	/**
+	 * Test webhook listener URL is well-formed.
+	 */
+	public function test_webhook_listener_url(): void {
+
+		$this->gateway->init();
+
+		$reflection = new \ReflectionClass($this->gateway);
+		$method     = $reflection->getMethod('get_webhook_listener_url');
+
+		$url = $method->invoke($this->gateway);
+		$this->assertNotEmpty($url);
+		$this->assertStringContainsString('paypal-rest', $url);
+	}
+
+	/**
+	 * Test maybe_install_webhook skips when gateway not active.
+	 */
+	public function test_maybe_install_webhook_skips_inactive_gateway(): void {
+
+		$this->gateway->init();
+
+		// Should not throw errors or install when gateway is not active
+		$this->gateway->maybe_install_webhook(
+			[],
+			['active_gateways' => ['stripe']],
+			[]
+		);
+
+		// No assertion needed — just verify it doesn't error
+		$this->assertTrue(true);
+	}
+}
diff --git a/tests/WP_Ultimo/Gateways/PayPal_Webhook_Handler_Test.php b/tests/WP_Ultimo/Gateways/PayPal_Webhook_Handler_Test.php
new file mode 100644
index 000000000..39da31095
--- /dev/null
+++ b/tests/WP_Ultimo/Gateways/PayPal_Webhook_Handler_Test.php
@@ -0,0 +1,504 @@
+<?php
+/**
+ * Tests for PayPal REST Webhook Handler.
+ *
+ * @package WP_Ultimo
+ * @subpackage Tests
+ * @since 2.x.x
+ */
+
+namespace WP_Ultimo\Gateways;
+
+use WP_UnitTestCase;
+use WP_Ultimo\Database\Payments\Payment_Status;
+use WP_Ultimo\Database\Memberships\Membership_Status;
+
+/**
+ * PayPal Webhook Handler Test class.
+ */
+class PayPal_Webhook_Handler_Test extends WP_UnitTestCase {
+
+	/**
+	 * Test handler instance.
+	 *
+	 * @var PayPal_Webhook_Handler
+	 */
+	protected $handler;
+
+	/**
+	 * Setup test.
+	 */
+	public function setUp(): void {
+		parent::setUp();
+
+		wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+		$this->handler = PayPal_Webhook_Handler::get_instance();
+		$this->handler->init();
+	}
+
+	/**
+	 * Test handler is singleton.
+	 */
+	public function test_singleton(): void {
+
+		$instance1 = PayPal_Webhook_Handler::get_instance();
+		$instance2 = PayPal_Webhook_Handler::get_instance();
+
+		$this->assertSame($instance1, $instance2);
+	}
+
+	/**
+	 * Test handler initialization registers webhook action.
+	 */
+	public function test_init_registers_webhook_action(): void {
+
+		$this->assertNotFalse(has_action('wu_paypal-rest_process_webhooks', [$this->handler, 'process_webhook']));
+	}
+
+	/**
+	 * Test API base URL in sandbox mode.
+	 */
+	public function test_api_base_url_sandbox(): void {
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('get_api_base_url');
+
+		$url = $method->invoke($this->handler);
+		$this->assertEquals('https://api-m.sandbox.paypal.com', $url);
+	}
+
+	/**
+	 * Test API base URL in live mode.
+	 */
+	public function test_api_base_url_live(): void {
+
+		wu_save_setting('paypal_rest_sandbox_mode', 0);
+
+		$handler = PayPal_Webhook_Handler::get_instance();
+		$handler->init();
+
+		$reflection = new \ReflectionClass($handler);
+		$method     = $reflection->getMethod('get_api_base_url');
+
+		$url = $method->invoke($handler);
+		$this->assertEquals('https://api-m.paypal.com', $url);
+	}
+
+	/**
+	 * Test verify_webhook_signature returns false with missing headers.
+	 */
+	public function test_verify_signature_fails_without_headers(): void {
+
+		// Clear any server headers
+		unset(
+			$_SERVER['HTTP_PAYPAL_AUTH_ALGO'],
+			$_SERVER['HTTP_PAYPAL_CERT_URL'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_ID'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME']
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('verify_webhook_signature');
+
+		$result = $method->invoke($this->handler, '{"test": true}');
+		$this->assertFalse($result);
+	}
+
+	/**
+	 * Test verify_webhook_signature with skip filter.
+	 */
+	public function test_verify_signature_skip_with_filter(): void {
+
+		// Clear server headers
+		unset(
+			$_SERVER['HTTP_PAYPAL_AUTH_ALGO'],
+			$_SERVER['HTTP_PAYPAL_CERT_URL'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_ID'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME']
+		);
+
+		add_filter('wu_paypal_skip_webhook_verification', '__return_true');
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('verify_webhook_signature');
+
+		$result = $method->invoke($this->handler, '{"test": true}');
+		$this->assertTrue($result);
+
+		remove_filter('wu_paypal_skip_webhook_verification', '__return_true');
+	}
+
+	/**
+	 * Test verify_webhook_signature fails without webhook_id.
+	 */
+	public function test_verify_signature_fails_without_webhook_id(): void {
+
+		// Set headers but no webhook ID
+		$_SERVER['HTTP_PAYPAL_AUTH_ALGO']         = 'SHA256withRSA';
+		$_SERVER['HTTP_PAYPAL_CERT_URL']          = 'https://api.sandbox.paypal.com/cert.pem';
+		$_SERVER['HTTP_PAYPAL_TRANSMISSION_ID']   = 'trans-123';
+		$_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG']  = 'sig-abc';
+		$_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME'] = '2026-01-01T00:00:00Z';
+
+		wu_save_setting('paypal_rest_sandbox_webhook_id', '');
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('verify_webhook_signature');
+
+		$result = $method->invoke($this->handler, '{"test": true}');
+		$this->assertFalse($result);
+
+		// Cleanup
+		unset(
+			$_SERVER['HTTP_PAYPAL_AUTH_ALGO'],
+			$_SERVER['HTTP_PAYPAL_CERT_URL'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_ID'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_SIG'],
+			$_SERVER['HTTP_PAYPAL_TRANSMISSION_TIME']
+		);
+	}
+
+	/**
+	 * Test get_membership_by_subscription returns null for empty ID.
+	 */
+	public function test_get_membership_by_subscription_empty(): void {
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('get_membership_by_subscription');
+
+		$result = $method->invoke($this->handler, '');
+		$this->assertNull($result);
+	}
+
+	/**
+	 * Test get_membership_by_subscription returns null/false for non-existent subscription.
+	 */
+	public function test_get_membership_by_subscription_not_found(): void {
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('get_membership_by_subscription');
+
+		$result = $method->invoke($this->handler, 'I-NONEXISTENT123');
+		$this->assertEmpty($result);
+	}
+
+	/**
+	 * Test handle_subscription_activated with valid membership.
+	 */
+	public function test_handle_subscription_activated(): void {
+
+		// Create test data
+		$customer = wu_create_customer(
+			[
+				'user_id'  => self::factory()->user->create(),
+				'email'    => 'paypal-test@example.com',
+				'username' => 'paypaltest',
+			]
+		);
+
+		$product = wu_create_product(
+			[
+				'name'          => 'PayPal Test Plan',
+				'slug'          => 'paypal-test-plan',
+				'type'          => 'plan',
+				'amount'        => 29.99,
+				'recurring'     => true,
+				'duration'      => 1,
+				'duration_unit' => 'month',
+				'currency'      => 'USD',
+				'list_order'    => 0,
+				'pricing_type'  => 'paid',
+				'feature_list'  => [],
+			]
+		);
+
+		$membership = wu_create_membership(
+			[
+				'customer_id'             => $customer->get_id(),
+				'plan_id'                 => $product->get_id(),
+				'gateway'                 => 'paypal-rest',
+				'gateway_subscription_id' => 'I-TESTACTIVATE',
+				'status'                  => Membership_Status::PENDING,
+				'amount'                  => 29.99,
+				'currency'                => 'USD',
+			]
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('handle_subscription_activated');
+
+		$method->invoke($this->handler, ['id' => 'I-TESTACTIVATE']);
+
+		// Reload membership
+		$membership = wu_get_membership($membership->get_id());
+		$this->assertEquals(Membership_Status::ACTIVE, $membership->get_status());
+	}
+
+	/**
+	 * Test handle_subscription_cancelled sets auto_renew to false.
+	 */
+	public function test_handle_subscription_cancelled(): void {
+
+		$customer = wu_create_customer(
+			[
+				'user_id'  => self::factory()->user->create(),
+				'email'    => 'paypal-cancel@example.com',
+				'username' => 'paypalcancel',
+			]
+		);
+
+		$product = wu_create_product(
+			[
+				'name'          => 'PayPal Cancel Plan',
+				'slug'          => 'paypal-cancel-plan',
+				'type'          => 'plan',
+				'amount'        => 19.99,
+				'recurring'     => true,
+				'duration'      => 1,
+				'duration_unit' => 'month',
+				'currency'      => 'USD',
+				'list_order'    => 0,
+				'pricing_type'  => 'paid',
+				'feature_list'  => [],
+			]
+		);
+
+		$membership = wu_create_membership(
+			[
+				'customer_id'             => $customer->get_id(),
+				'plan_id'                 => $product->get_id(),
+				'gateway'                 => 'paypal-rest',
+				'gateway_subscription_id' => 'I-TESTCANCEL',
+				'status'                  => Membership_Status::ACTIVE,
+				'auto_renew'              => true,
+				'amount'                  => 19.99,
+				'currency'                => 'USD',
+			]
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('handle_subscription_cancelled');
+
+		$method->invoke($this->handler, ['id' => 'I-TESTCANCEL']);
+
+		// Reload membership
+		$membership = wu_get_membership($membership->get_id());
+		$this->assertFalse($membership->should_auto_renew());
+	}
+
+	/**
+	 * Test handle_payment_completed creates renewal payment and prevents duplicates.
+	 */
+	public function test_handle_payment_completed_creates_renewal(): void {
+
+		$customer = wu_create_customer(
+			[
+				'user_id'  => self::factory()->user->create(),
+				'email'    => 'paypal-renew@example.com',
+				'username' => 'paypalrenew',
+			]
+		);
+
+		$product = wu_create_product(
+			[
+				'name'          => 'PayPal Renewal Plan',
+				'slug'          => 'paypal-renewal-plan',
+				'type'          => 'plan',
+				'amount'        => 49.99,
+				'recurring'     => true,
+				'duration'      => 1,
+				'duration_unit' => 'month',
+				'currency'      => 'USD',
+				'list_order'    => 0,
+				'pricing_type'  => 'paid',
+				'feature_list'  => [],
+			]
+		);
+
+		$membership = wu_create_membership(
+			[
+				'customer_id'             => $customer->get_id(),
+				'plan_id'                 => $product->get_id(),
+				'gateway'                 => 'paypal-rest',
+				'gateway_subscription_id' => 'I-TESTRENEWAL',
+				'status'                  => Membership_Status::ACTIVE,
+				'amount'                  => 49.99,
+				'currency'                => 'USD',
+			]
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('handle_payment_completed');
+
+		$resource = [
+			'id'                   => 'SALE-12345',
+			'billing_agreement_id' => 'I-TESTRENEWAL',
+			'amount'               => [
+				'total'    => '49.99',
+				'currency' => 'USD',
+			],
+		];
+
+		$method->invoke($this->handler, $resource);
+
+		// Check that a payment was created
+		$payment = wu_get_payment_by('gateway_payment_id', 'SALE-12345');
+		$this->assertNotNull($payment);
+		$this->assertEquals(Payment_Status::COMPLETED, $payment->get_status());
+		$this->assertEquals('paypal-rest', $payment->get_gateway());
+
+		// Call again with same sale ID — should not create duplicate
+		$method->invoke($this->handler, $resource);
+
+		// Still only one payment
+		$all_payments = wu_get_payments(
+			[
+				'gateway_payment_id' => 'SALE-12345',
+			]
+		);
+		$this->assertCount(1, $all_payments);
+	}
+
+	/**
+	 * Test handle_subscription_suspended sets membership on hold.
+	 */
+	public function test_handle_subscription_suspended(): void {
+
+		$customer = wu_create_customer(
+			[
+				'user_id'  => self::factory()->user->create(),
+				'email'    => 'paypal-suspend@example.com',
+				'username' => 'paypalsuspend',
+			]
+		);
+
+		$product = wu_create_product(
+			[
+				'name'          => 'PayPal Suspend Plan',
+				'slug'          => 'paypal-suspend-plan',
+				'type'          => 'plan',
+				'amount'        => 9.99,
+				'recurring'     => true,
+				'duration'      => 1,
+				'duration_unit' => 'month',
+				'currency'      => 'USD',
+				'list_order'    => 0,
+				'pricing_type'  => 'paid',
+				'feature_list'  => [],
+			]
+		);
+
+		$membership = wu_create_membership(
+			[
+				'customer_id'             => $customer->get_id(),
+				'plan_id'                 => $product->get_id(),
+				'gateway'                 => 'paypal-rest',
+				'gateway_subscription_id' => 'I-TESTSUSPEND',
+				'status'                  => Membership_Status::ACTIVE,
+				'amount'                  => 9.99,
+				'currency'                => 'USD',
+			]
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('handle_subscription_suspended');
+
+		$method->invoke($this->handler, ['id' => 'I-TESTSUSPEND']);
+
+		// Reload membership
+		$membership = wu_get_membership($membership->get_id());
+		$this->assertEquals(Membership_Status::ON_HOLD, $membership->get_status());
+	}
+
+	/**
+	 * Test handle_capture_refunded marks payment as refunded.
+	 */
+	public function test_handle_capture_refunded(): void {
+
+		$customer = wu_create_customer(
+			[
+				'user_id'  => self::factory()->user->create(),
+				'email'    => 'paypal-refund@example.com',
+				'username' => 'paypalrefund',
+			]
+		);
+
+		$product = wu_create_product(
+			[
+				'name'          => 'PayPal Refund Plan',
+				'slug'          => 'paypal-refund-plan',
+				'type'          => 'plan',
+				'amount'        => 59.99,
+				'recurring'     => false,
+				'duration'      => 0,
+				'duration_unit' => 'month',
+				'currency'      => 'USD',
+				'list_order'    => 0,
+				'pricing_type'  => 'paid',
+				'feature_list'  => [],
+			]
+		);
+
+		$membership = wu_create_membership(
+			[
+				'customer_id' => $customer->get_id(),
+				'plan_id'     => $product->get_id(),
+				'gateway'     => 'paypal-rest',
+				'status'      => Membership_Status::ACTIVE,
+				'amount'      => 59.99,
+				'currency'    => 'USD',
+			]
+		);
+
+		$payment = wu_create_payment(
+			[
+				'customer_id'        => $customer->get_id(),
+				'membership_id'      => $membership->get_id(),
+				'gateway'            => 'paypal-rest',
+				'gateway_payment_id' => '8MC585209K746631H',
+				'status'             => Payment_Status::COMPLETED,
+				'total'              => 59.99,
+				'subtotal'           => 59.99,
+				'currency'           => 'USD',
+				'product_id'         => $product->get_id(),
+			]
+		);
+
+		$reflection = new \ReflectionClass($this->handler);
+		$method     = $reflection->getMethod('handle_capture_refunded');
+
+		$resource = [
+			'id'     => 'REFUND-456',
+			'amount' => ['value' => '59.99'],
+			'links'  => [
+				[
+					'rel'  => 'up',
+					'href' => 'https://api.sandbox.paypal.com/v2/payments/captures/8MC585209K746631H',
+				],
+			],
+		];
+
+		$method->invoke($this->handler, $resource);
+
+		// Reload payment
+		$payment = wu_get_payment($payment->get_id());
+		$this->assertEquals(Payment_Status::REFUND, $payment->get_status());
+	}
+
+	/**
+	 * Cleanup after all tests.
+	 */
+	public static function tear_down_after_class(): void {
+		global $wpdb;
+
+		$wpdb->query("TRUNCATE TABLE {$wpdb->base_prefix}wu_memberships");
+		$wpdb->query("TRUNCATE TABLE {$wpdb->base_prefix}wu_payments");
+		$wpdb->query("TRUNCATE TABLE {$wpdb->base_prefix}wu_customers");
+		$wpdb->query("TRUNCATE TABLE {$wpdb->base_prefix}wu_products");
+
+		parent::tear_down_after_class();
+	}
+}
diff --git a/tests/WP_Ultimo/Managers/Gateway_Manager_Test.php b/tests/WP_Ultimo/Managers/Gateway_Manager_Test.php
index 4a93022d9..37aa4fec5 100644
--- a/tests/WP_Ultimo/Managers/Gateway_Manager_Test.php
+++ b/tests/WP_Ultimo/Managers/Gateway_Manager_Test.php
@@ -12,6 +12,7 @@
 use WP_Ultimo\Gateways\Base_Gateway;
 use WP_Ultimo\Gateways\Free_Gateway;
 use WP_Ultimo\Gateways\Manual_Gateway;
+use WP_Ultimo\Gateways\PayPal_REST_Gateway;
 use WP_UnitTestCase;
 
 /**
@@ -65,6 +66,8 @@ public function test_add_default_gateways() {
 		$this->assertIsArray($registered_gateways);
 		$this->assertArrayHasKey('free', $registered_gateways);
 		$this->assertArrayHasKey('manual', $registered_gateways);
+		$this->assertArrayHasKey('paypal-rest', $registered_gateways);
+		// Legacy PayPal is conditionally registered (only when active or has credentials)
 	}
 
 	/**
@@ -181,4 +184,108 @@ public function test_gateway_error_handling() {
 			$this->assertTrue($e instanceof \Error);
 		}
 	}
+
+	/**
+	 * Test legacy PayPal is hidden when no credentials or active gateway.
+	 */
+	public function test_legacy_paypal_hidden_without_config(): void {
+
+		// Ensure no legacy PayPal credentials or active status
+		wu_save_setting('paypal_test_username', '');
+		wu_save_setting('paypal_live_username', '');
+		wu_save_setting('active_gateways', ['stripe']);
+
+		// Clear registered gateways
+		$reflection = new \ReflectionClass($this->manager);
+		$property   = $reflection->getProperty('registered_gateways');
+
+		if (PHP_VERSION_ID < 80100) {
+			$property->setAccessible(true);
+		}
+
+		$property->setValue($this->manager, []);
+
+		$this->manager->add_default_gateways();
+
+		$registered = $this->manager->get_registered_gateways();
+
+		$this->assertArrayHasKey('paypal-rest', $registered);
+		$this->assertArrayNotHasKey('paypal', $registered, 'Legacy PayPal should NOT be registered without credentials');
+	}
+
+	/**
+	 * Test legacy PayPal is shown when it has existing credentials.
+	 */
+	public function test_legacy_paypal_shown_with_credentials(): void {
+
+		wu_save_setting('paypal_test_username', 'legacy_api_user');
+		wu_save_setting('active_gateways', ['stripe']);
+
+		$reflection = new \ReflectionClass($this->manager);
+		$property   = $reflection->getProperty('registered_gateways');
+
+		if (PHP_VERSION_ID < 80100) {
+			$property->setAccessible(true);
+		}
+
+		$property->setValue($this->manager, []);
+
+		$this->manager->add_default_gateways();
+
+		$registered = $this->manager->get_registered_gateways();
+
+		$this->assertArrayHasKey('paypal', $registered, 'Legacy PayPal should be registered when credentials exist');
+
+		// Cleanup
+		wu_save_setting('paypal_test_username', '');
+	}
+
+	/**
+	 * Test legacy PayPal is shown when it is an active gateway.
+	 */
+	public function test_legacy_paypal_shown_when_active(): void {
+
+		wu_save_setting('paypal_test_username', '');
+		wu_save_setting('paypal_live_username', '');
+		wu_save_setting('active_gateways', ['paypal']);
+
+		$reflection = new \ReflectionClass($this->manager);
+		$property   = $reflection->getProperty('registered_gateways');
+
+		if (PHP_VERSION_ID < 80100) {
+			$property->setAccessible(true);
+		}
+
+		$property->setValue($this->manager, []);
+
+		$this->manager->add_default_gateways();
+
+		$registered = $this->manager->get_registered_gateways();
+
+		$this->assertArrayHasKey('paypal', $registered, 'Legacy PayPal should be registered when it is active');
+
+		// Cleanup
+		wu_save_setting('active_gateways', []);
+	}
+
+	/**
+	 * Test PayPal REST gateway is always registered.
+	 */
+	public function test_paypal_rest_always_registered(): void {
+
+		$reflection = new \ReflectionClass($this->manager);
+		$property   = $reflection->getProperty('registered_gateways');
+
+		if (PHP_VERSION_ID < 80100) {
+			$property->setAccessible(true);
+		}
+
+		$property->setValue($this->manager, []);
+
+		$this->manager->add_default_gateways();
+
+		$registered = $this->manager->get_registered_gateways();
+
+		$this->assertArrayHasKey('paypal-rest', $registered, 'PayPal REST should always be registered');
+	}
 }
diff --git a/tests/e2e/cypress/fixtures/setup-paypal-gateway.php b/tests/e2e/cypress/fixtures/setup-paypal-gateway.php
new file mode 100644
index 000000000..057a3aa11
--- /dev/null
+++ b/tests/e2e/cypress/fixtures/setup-paypal-gateway.php
@@ -0,0 +1,42 @@
+<?php
+/**
+ * Enable the PayPal REST gateway with sandbox API keys for e2e testing.
+ * Usage: wp eval-file setup-paypal-gateway.php <client_id> <client_secret>
+ */
+
+$client_id     = isset($args[0]) ? $args[0] : '';
+$client_secret = isset($args[1]) ? $args[1] : '';
+
+if (empty($client_id) || empty($client_secret)) {
+	echo wp_json_encode(['error' => 'Missing PayPal sandbox keys. Pass client_id and client_secret as arguments.']);
+	return;
+}
+
+// Enable sandbox mode
+wu_save_setting('paypal_rest_sandbox_mode', 1);
+
+// Set sandbox keys
+wu_save_setting('paypal_rest_sandbox_client_id', $client_id);
+wu_save_setting('paypal_rest_sandbox_client_secret', $client_secret);
+
+// Show manual keys so settings reflect the credentials
+wu_save_setting('paypal_rest_show_manual_keys', 1);
+
+// Add paypal-rest to active gateways while keeping existing ones
+$active_gateways = (array) wu_get_setting('active_gateways', []);
+
+if ( ! in_array('paypal-rest', $active_gateways, true)) {
+	$active_gateways[] = 'paypal-rest';
+}
+
+wu_save_setting('active_gateways', $active_gateways);
+
+echo wp_json_encode(
+	[
+		'success'           => true,
+		'active_gateways'   => wu_get_setting('active_gateways', []),
+		'sandbox_mode'      => wu_get_setting('paypal_rest_sandbox_mode', false),
+		'client_id_set'     => ! empty(wu_get_setting('paypal_rest_sandbox_client_id')),
+		'client_secret_set' => ! empty(wu_get_setting('paypal_rest_sandbox_client_secret')),
+	]
+);
diff --git a/tests/e2e/cypress/fixtures/verify-paypal-checkout-results.php b/tests/e2e/cypress/fixtures/verify-paypal-checkout-results.php
new file mode 100644
index 000000000..5875a250f
--- /dev/null
+++ b/tests/e2e/cypress/fixtures/verify-paypal-checkout-results.php
@@ -0,0 +1,52 @@
+<?php
+/**
+ * Verify PayPal checkout results: payment, membership, and site.
+ * Outputs a JSON object with the status of each entity.
+ *
+ * Since PayPal redirects to paypal.com for approval, the payment will
+ * still be pending until the user returns from PayPal.
+ */
+
+// UM payment (most recent)
+$payments           = WP_Ultimo\Models\Payment::query(
+	[
+		'number'  => 1,
+		'orderby' => 'id',
+		'order'   => 'DESC',
+	]
+);
+$um_payment_status  = $payments ? $payments[0]->get_status() : 'no-payments';
+$um_payment_gateway = $payments ? $payments[0]->get_gateway() : 'none';
+$um_payment_total   = $payments ? (float) $payments[0]->get_total() : 0;
+$gateway_payment_id = $payments ? $payments[0]->get_gateway_payment_id() : '';
+
+// UM membership (most recent)
+$memberships             = WP_Ultimo\Models\Membership::query(
+	[
+		'number'  => 1,
+		'orderby' => 'id',
+		'order'   => 'DESC',
+	]
+);
+$um_membership_status    = $memberships ? $memberships[0]->get_status() : 'no-memberships';
+$gateway_customer_id     = $memberships ? $memberships[0]->get_gateway_customer_id() : '';
+$gateway_subscription_id = $memberships ? $memberships[0]->get_gateway_subscription_id() : '';
+
+// UM sites
+$sites         = WP_Ultimo\Models\Site::query(['type__in' => ['customer_owned']]);
+$um_site_count = count($sites);
+$um_site_type  = $sites ? $sites[0]->get_type() : 'no-sites';
+
+echo wp_json_encode(
+	[
+		'um_payment_status'       => $um_payment_status,
+		'um_payment_gateway'      => $um_payment_gateway,
+		'um_payment_total'        => $um_payment_total,
+		'um_membership_status'    => $um_membership_status,
+		'um_site_count'           => $um_site_count,
+		'um_site_type'            => $um_site_type,
+		'gateway_payment_id'      => $gateway_payment_id,
+		'gateway_customer_id'     => $gateway_customer_id,
+		'gateway_subscription_id' => $gateway_subscription_id,
+	]
+);
diff --git a/tests/e2e/cypress/integration/035-paypal-checkout-flow.spec.js b/tests/e2e/cypress/integration/035-paypal-checkout-flow.spec.js
new file mode 100644
index 000000000..a844f2f4d
--- /dev/null
+++ b/tests/e2e/cypress/integration/035-paypal-checkout-flow.spec.js
@@ -0,0 +1,193 @@
+describe("PayPal REST Gateway Checkout Flow", () => {
+	const timestamp = Date.now();
+	const customerData = {
+		username: `paypalcust${timestamp}`,
+		email: `paypalcust${timestamp}@test.com`,
+		password: "xK9#mL2$vN5@qR",
+	};
+	const siteData = {
+		title: "PayPal Test Site",
+		path: `paypalsite${timestamp}`,
+	};
+
+	before(() => {
+		const clientId = Cypress.env("PAYPAL_SANDBOX_CLIENT_ID");
+		const clientSecret = Cypress.env("PAYPAL_SANDBOX_CLIENT_SECRET");
+
+		if (!clientId || !clientSecret) {
+			throw new Error(
+				"Skipping PayPal tests: PAYPAL_SANDBOX_CLIENT_ID and PAYPAL_SANDBOX_CLIENT_SECRET env vars are required"
+			);
+		}
+
+		cy.loginByForm(
+			Cypress.env("admin").username,
+			Cypress.env("admin").password
+		);
+
+		// Enable PayPal gateway with sandbox keys
+		cy.exec(
+			`npx wp-env run tests-cli wp eval-file /var/www/html/wp-content/plugins/ultimate-multisite/tests/e2e/cypress/fixtures/setup-paypal-gateway.php '${clientId}' '${clientSecret}'`,
+			{ timeout: 60000 }
+		).then((result) => {
+			const data = JSON.parse(result.stdout.trim());
+			cy.log(`PayPal setup: ${JSON.stringify(data)}`);
+			expect(data.success).to.equal(true);
+		});
+	});
+
+	it("Should show PayPal as a payment option on the checkout form", {
+		retries: 0,
+	}, () => {
+		cy.clearCookies();
+		cy.visit("/register", { failOnStatusCode: false });
+
+		// Wait for checkout form to render
+		cy.get("#field-email_address", { timeout: 30000 }).should(
+			"be.visible"
+		);
+		cy.wait(3000);
+
+		// Select the plan
+		cy.get('#wrapper-field-pricing_table label[id^="wu-product-"]', {
+			timeout: 15000,
+		})
+			.first()
+			.click();
+
+		cy.wait(3000);
+
+		// PayPal gateway radio should be available
+		cy.get(
+			'input[type="radio"][name="gateway"][value="paypal-rest"]',
+			{ timeout: 10000 }
+		).should("exist");
+	});
+
+	it("Should submit checkout form with PayPal gateway selected", {
+		retries: 0,
+	}, () => {
+		cy.clearCookies();
+		cy.visit("/register", { failOnStatusCode: false });
+
+		// Wait for checkout form to render
+		cy.get("#field-email_address", { timeout: 30000 }).should(
+			"be.visible"
+		);
+		cy.wait(3000);
+
+		// Select the plan
+		cy.get('#wrapper-field-pricing_table label[id^="wu-product-"]', {
+			timeout: 15000,
+		})
+			.first()
+			.click();
+
+		cy.wait(3000);
+
+		// Fill account details
+		cy.get("#field-email_address").clear().type(customerData.email);
+		cy.get("#field-username")
+			.should("be.visible")
+			.clear()
+			.type(customerData.username);
+		cy.get("#field-password")
+			.should("be.visible")
+			.clear()
+			.type(customerData.password);
+
+		cy.get("body").then(($body) => {
+			if ($body.find("#field-password_conf").length > 0) {
+				cy.get("#field-password_conf").clear().type(customerData.password);
+			}
+		});
+
+		// Fill site details
+		cy.get("#field-site_title")
+			.should("be.visible")
+			.clear()
+			.type(siteData.title);
+		cy.get("#field-site_url")
+			.should("be.visible")
+			.clear()
+			.type(siteData.path);
+
+		// Select PayPal REST gateway
+		cy.get(
+			'input[type="radio"][name="gateway"][value="paypal-rest"]'
+		).check({ force: true });
+
+		// Fill billing address
+		cy.get("#field-billing_country", { timeout: 15000 })
+			.should("be.visible")
+			.select("US");
+
+		cy.get("#field-billing_zip_code", { timeout: 15000 })
+			.should("be.visible")
+			.clear()
+			.type("94105");
+
+		// Intercept the checkout AJAX call to capture the redirect URL.
+		// PayPal checkout creates an order and returns an approval_url that
+		// redirects the user to paypal.com — we can't follow that in CI,
+		// but we can verify the gateway processes the request correctly.
+		cy.intercept("POST", "**/admin-ajax.php").as("checkoutAjax");
+
+		// Submit the checkout form
+		cy.get(
+			'#wrapper-field-checkout button[type="submit"], button.wu-checkout-submit, #field-checkout, button[type="submit"]',
+			{ timeout: 10000 }
+		)
+			.filter(":visible")
+			.last()
+			.click();
+
+		// Wait for the AJAX response or a redirect.
+		// PayPal checkout will either:
+		// 1. Redirect to paypal.com for payment approval (success)
+		// 2. Stay on the page with an error message
+		// 3. Redirect to status=done (for $0 orders)
+		//
+		// We check for either a redirect or verify the checkout processed
+		cy.wait(15000);
+
+		// Check the current URL — if redirected to paypal.com, the checkout worked
+		cy.url().then((url) => {
+			if (url.includes("paypal.com")) {
+				// Successfully redirected to PayPal for approval
+				cy.log("PayPal redirect successful");
+				expect(url).to.include("paypal.com");
+			} else if (url.includes("status=done")) {
+				// Free or $0 order completed
+				cy.log("Order completed (free/zero amount)");
+			} else {
+				// Still on register page — check if form processed correctly
+				cy.log(`Still on page: ${url}`);
+				// The checkout should have at least created the pending entities
+			}
+		});
+	});
+
+	it("Should verify PayPal gateway is correctly configured via WP-CLI", () => {
+		cy.exec(
+			`npx wp-env run tests-cli wp eval '
+				$gateways = (array) wu_get_setting("active_gateways", []);
+				$sandbox = wu_get_setting("paypal_rest_sandbox_mode", 0);
+				$client_id = wu_get_setting("paypal_rest_sandbox_client_id", "");
+				echo json_encode([
+					"paypal_active" => in_array("paypal-rest", $gateways),
+					"sandbox_mode" => (bool)(int)$sandbox,
+					"has_client_id" => !empty($client_id),
+				]);
+			'`,
+			{ timeout: 30000 }
+		).then((result) => {
+			const data = JSON.parse(result.stdout.trim());
+			cy.log(`PayPal config: ${JSON.stringify(data)}`);
+
+			expect(data.paypal_active).to.equal(true);
+			expect(data.sandbox_mode).to.equal(true);
+			expect(data.has_client_id).to.equal(true);
+		});
+	});
+});
diff --git a/views/checkout/fields/field-payment-methods.php b/views/checkout/fields/field-payment-methods.php
index 5610a7bfb..ca6684e6b 100644
--- a/views/checkout/fields/field-payment-methods.php
+++ b/views/checkout/fields/field-payment-methods.php
@@ -40,6 +40,12 @@
 				<?php $field->print_html_attributes(); ?>
 			>
 
+			<?php if (! empty($option_name)) : ?>
+				<div class="wu-payment-method-badge wu-mb-2">
+					<?php echo wp_kses_post($option_name); ?>
+				</div>
+			<?php endif; ?>
+
 		<?php else : ?>
 
 			<label class="wu-block" for="field-<?php echo esc_attr($field->id); ?>-<?php echo esc_attr($option_value); ?>">
@@ -55,7 +61,7 @@ class="<?php echo esc_attr(trim($field->classes)); ?>"
 					<?php checked((string) $field->value === (string) $option_value, true); ?>
 				>
 
-				<?php echo esc_html($option_name); ?>
+				<?php echo wp_kses_post($option_name); ?>
 
 			</label>