I have a web site and I want to offer a few levels of service - one free, one for a one-off payment, and one for a subscription. My first inclination is to use Paypal for the payment options. I understand that I can make some login page on my site where you create an account or login to an existing account, and then I can make an API call to Paypal to see what they've paid for and give them the appropriate level of access, and redirect to Paypal for them to pay for the access they want. I'm not sure yet if the free service will require a login or not.
But having read Joel Spolsky's and Bruce Schnier's blogs, I'm conscious of how hard it is to do authentication right, and what a pain it is for users to have to create an account or login to my site, and then create an account or login to Paypal. Is there a way to use Paypal's login system directly, so they login to Paypal and Paypal sends me back a token saying who they are and what they've paid for? That kind of sounds like almost an OpenID, or something similar?