Yes. That's the only way it works.
It sounds like you've not gone through a complete checkout yet.
A - The customer adds to their cart.
B - Then has two choices:
- Normal checkout, which requires creation of or login to their account in your store.
- Jump directly to PayPal to choose their funding source (credit card or paypal balance, etc), and returns to your store
C - Customer is taken to the Shipping choices page
D - Customer is taken to the Payment choices page where they can choose a payment method or enter coupons and gift certificates. If they chose Express Checkout earlier in "B" above, then the PayPal option will be auto-selected here and no other choices offered.
Taxes will be calculated and shown.
E - Customer is taken to the Confirmation screen where they see the actual final purchase amount including shipping and taxes. When they click the submit button on this page, one of two things will happen:
1 - if they chose Express Checkout earlier, THIS IS WHEN their PayPal account/card will be charged and funds transferred to the storeowner.
2 - If they chose normal checkout and selected PayPal on the payment-options screen, then they'll be taken to PayPal to login and choose funding and confirm the final tax-included and shipping-included amount (because those amounts are known as a result of having given their address details to you when they created their account in your store). Funds will of course be transferred to the storeowner when they click the "Pay" button in PayPal.
F - Then the customer is taken to your store's Checkout-Success screen to thank them for placing their order.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.