Paypal PDT, Fail Error: 4020

There are a few reasons that could cause paypal to send back:

FAIL ERROR: 4020

When you attempt to verify PDT transaction data by posting a _notify-synch command.  However, in 9 times out of 10 the cause is due to the request containing an incorrect ‘at’ or authorisation token argument.

The ‘authorisation token’, or ‘Identity Token’ is a big long alphanumeric string, to find yours log into your paypal account, click on ‘Profile’, then click on ‘Website Payment Preferences’, scroll down to the ‘Payment Data Transfer’ section – you will see your ‘Identity Token’ at the end of this section.

This token must be included in your _notify-synch command as an argument named ‘at’.

Some more information on Paypal’s PTD can be found here:
https://www.paypal.com/us/cgi-bin/webscr?cmd=p/xcl/rec/pdt-techview-outside