online payment option

No, we're connecting to HubSpot. PayPal security may reasonably be stricter than HubSpot, so I can only walk through how we handled it.

First of all, even though we use Webhooks with HubSpot, we don't actually use the Webhooks Channel. We found we can do what we needed with the JSON Channel. 

For us, the outgoing connections from Quickbase to HubSpot are where we use OAuth. The first step was to set up the initial authorization. For HubSpot, that involved "creating an app", which meant registering Quickbase as our "app" and identifying which parts of the HubSpot API we wanted to grant Quickbase access to. This generated an authorization URL for that app, along with a Client ID and Client Secret, which we used to get an Access Token and a Refresh Token by logging as a HubSpot user having all the access we were authorizing for the "app" and manually loading the authorization URL in the same browser. This was the part that involved the OAuth redirect. The authorization URL went to a page that asked us to select the appropriate account and returned us to the redirect URL with the two tokens added to the redirect URL as query strings. We manually copied them both for use in our Pipelines. 

In our case with HubSpot, the Access Tokens only last for 30 minutes, so each outgoing pipeline refreshes the token by making a Fetch JSON step to POST the Client ID, Client Secret and Refresh Token to HubSpot, which responds with a new Access Token, which can be parsed out with an Iterate Over JSON Records step. After refreshing the Access Token, we use additional Fetch JSON steps to connect to the various endpoints documented for the API.

For incoming updates, we set up an Incoming JSON Pipeline. That generated an endpoint URL that the other side uses for sending Webhooks event notifications.This may be where you run into trouble with PayPal, because the only security modes that the Incoming JSON step supports are JWT, which we have yet to find any other system that uses, and the old HTTP Basic. (The Incoming Request step in the Webhooks Channel, by the way, supports only JWT.) The only other option is no security,  so if PayPal even permits sending Webhooks notifications without security, you'll have to assess the risk level to your Quickbase application.

Assuming you can use the Incoming JSON step, the next step in the Pipeline is to Iterate Over JSON Records to interpret the notification. We couldn't find any documentation in HubSpot for the format of the notifications, so we had to trigger events and intercept the notifications to figure out a JSON schema sample that would parse them. From there, we use whatever steps are applicable to create, update or, if you permit deletions, delete records.

I hope this helps, and in any case, good luck with your project.