{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"43c933c2cf11754449b2f20d1da9454b1de424a6938d3ea599e9cfc9077385dd","entry":{"id":"square/developer","name":"Square Developer (API access)","vendor":"Square","summary":"Free Square developer account and application with separate Sandbox and production access tokens. Taking real payments needs an activated, identity-verified Square seller account; apps for other sellers must use OAuth.","aliases":["square","squareup","square-api"],"category":"payments","group":"C","homepage":"https://developer.squareup.com/","docs":["https://developer.squareup.com/docs/get-started/create-account-and-application","https://developer.squareup.com/docs/build-basics/access-tokens","https://developer.squareup.com/docs/oauth-api/overview"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"create-account","url":"https://developer.squareup.com/docs/get-started/create-account-and-application","title":"Square Developer – Create an Account and Application","accessed":"2026-10-25","supports":"Free developer account; sign-up collects name, email, password, country, business name and application name and requires agreeing to Square's terms; production payments need account activation at squareup.com/activation","kind":"official"},{"id":"access-tokens","url":"https://developer.squareup.com/docs/build-basics/access-tokens","title":"Square Developer – Access tokens","accessed":"2026-10-25","supports":"Personal vs OAuth access tokens; each application has a production personal access token and a separate Sandbox token on the Credentials page; multi-tenant apps should use OAuth in production; Webhook Subscriptions and Events APIs need the personal access token","kind":"official"},{"id":"sandbox","url":"https://developer.squareup.com/docs/devtools/sandbox/overview","title":"Square Developer – Square Sandbox","accessed":"2026-10-25","supports":"Free, isolated Sandbox per application; Sandbox and production base URLs; credentials do not work across environments","kind":"official"},{"id":"oauth","url":"https://developer.squareup.com/docs/oauth-api/overview","title":"Square Developer – OAuth API","accessed":"2026-10-25","supports":"Code and PKCE flows; HTTPS redirect URL (localhost HTTP allowed in Sandbox); codes expire after 5 minutes; access tokens expire after 30 days; refresh token rules","kind":"official"},{"id":"webhooks-validate","url":"https://developer.squareup.com/docs/webhooks/step3validate","title":"Square Developer – Verify and validate an event notification","accessed":"2026-10-25","supports":"x-square-hmacsha256-signature header; signature key and notification URL under Webhooks in the Developer Console","kind":"official"},{"id":"payment-terms","url":"https://squareup.com/us/en/legal/general/payment","title":"Square Payment Terms (US)","accessed":"2026-10-25","supports":"Prohibited businesses list; underwriting and identity verification including consumer reports; seller liability for chargebacks; reserves and withheld payouts","kind":"official"},{"id":"developer-terms","url":"https://squareup.com/us/en/legal/general/developers","title":"Square Developer Terms of Service (last updated 10 September 2026)","accessed":"2026-10-25","supports":"Sellers must log in via OAuth and you must not solicit or store Square passwords; app-fee collection rules and agency; you handle your indirect taxes and disputes with sellers; access prohibitions including AI training on Square data","kind":"official"}],"allowed_domains":["developer.squareup.com","squareup.com","app.squareup.com"],"account_model":{"summary":"A Square account holds one or more applications in the Developer Console. Each application has a Sandbox and a production environment with separate credentials. A personal access token acts on your own Square account; OAuth tokens act on other sellers' accounts.","accounts":[{"name":"Square account (developer)","kind":"developer","owned_by":"the person","required":true,"note":"Free to create."},{"name":"Application","kind":"project","parent":"Square account (developer)","required":true,"note":"Created in the Developer Console; has a Sandbox and a production side."},{"name":"Sandbox test seller account","kind":"other","parent":"Application","required":false,"note":"Each test account has its own Sandbox Square Dashboard."},{"name":"Activated Square seller account","kind":"organisation","owned_by":"the business","required":false,"note":"Needed only to take real payments in production on your own account."}],"notes":["Credentials and resources from one environment cannot be used in the other.","Apps that serve many sellers should use OAuth access tokens in production."]},"have_ready":[{"kind":"domain_email","description":"Email address for the Square account","needed_for":["developer-account"],"auto_check":"none","source":"create-account"},{"kind":"government_id","description":"Identity details for the seller (Square may request identity-verifying information and a consumer report)","why":"Square reviews sign-up information to verify that you are you and shares the application with bank partners.","needed_for":["activate-seller"],"auto_check":"none","source":"payment-terms"},{"kind":"bank_account","description":"An ACH-enabled bank account in the seller's name (US)","why":"You must link an ACH-enabled bank account or request a check to receive proceeds.","needed_for":["activate-seller"],"auto_check":"none","source":"payment-terms"},{"kind":"tax_id","description":"Business tax details for activation [to verify exact fields]","needed_for":["activate-seller"],"auto_check":"none","source":"payment-terms"}],"steps":[{"id":"developer-account","title":"Create a Square developer account and first application","summary":"You sign up yourself, agree to Square's terms, and enter your business name and an application name. Square then opens the new application in the Developer Console.","route":"guided","depends_on":[],"gate":"human_terms","url":"https://developer.squareup.com/","sources":["create-account"]},{"id":"sandbox-token","title":"Copy the Sandbox access token","summary":"Open the application, choose Sandbox at the top, open Credentials and copy the Sandbox access token. Use it with https://connect.squareupsandbox.com.","route":"guided","depends_on":["developer-account"],"gate":"human_login","url":"https://developer.squareup.com/","capture":{"env":"SQUARE_SANDBOX_ACCESS_TOKEN","kind":"token"},"sources":["access-tokens","sandbox"]},{"id":"application-id","title":"Note the application ID","summary":"Copy the application ID from the application's Credentials page; OAuth token requests need it. [to verify exact page]","route":"guided","depends_on":["developer-account"],"gate":"none","url":"https://developer.squareup.com/","capture":{"env":"SQUARE_APPLICATION_ID","kind":"client_id"},"sources":["oauth"]},{"id":"activate-seller","title":"Activate your Square account for real payments","summary":"Before taking payments in production, activate the Square account at squareup.com/activation. Square underwrites the account and verifies identity, and its bank partners may decline it.","route":"guided","depends_on":["developer-account"],"gate":"human_identity","url":"https://squareup.com/activation","sources":["create-account","payment-terms"]},{"id":"production-token","title":"Copy the production personal access token","summary":"In Credentials, choose Production, then Show, and copy the token. It gives full access to your own Square account; use it only for your own integration.","route":"guided","depends_on":["developer-account"],"gate":"human_login","url":"https://developer.squareup.com/","capture":{"env":"SQUARE_ACCESS_TOKEN","kind":"token"},"sources":["access-tokens"]},{"id":"oauth-setup","title":"Set up OAuth for other sellers (multi-seller apps)","summary":"Register an HTTPS redirect URL, build the authorisation URL, and exchange the returned code with ObtainToken. Codes expire after 5 minutes and access tokens after 30 days, so refresh them. Sellers must log in through OAuth; never ask for or store their Square passwords.","route":"guided","depends_on":["application-id"],"gate":"human_submit","capture":{"env":"SQUARE_APPLICATION_SECRET","kind":"secret"},"optional":true,"sources":["oauth","developer-terms"]},{"id":"webhook","title":"Subscribe to webhooks (optional)","summary":"Create a webhook subscription in the Developer Console and copy its signature key to validate x-square-hmacsha256-signature.","route":"guided","depends_on":["developer-account"],"gate":"human_submit","capture":{"env":"SQUARE_WEBHOOK_SIGNATURE_KEY","kind":"webhook_secret"},"optional":true,"sources":["webhooks-validate"]}],"outputs":[{"name":"SQUARE_APPLICATION_ID","description":"Application ID of the Square application","secret":false,"from_step":"application-id"},{"name":"SQUARE_SANDBOX_ACCESS_TOKEN","description":"Sandbox access token (connect.squareupsandbox.com)","secret":true,"environments":["development","test"],"from_step":"sandbox-token"},{"name":"SQUARE_ACCESS_TOKEN","description":"Production personal access token for your own Square account (connect.squareup.com)","secret":true,"environments":["production"],"from_step":"production-token"},{"name":"SQUARE_APPLICATION_SECRET","description":"OAuth application secret used with the code flow [to verify location in the console]","secret":true,"from_step":"oauth-setup"},{"name":"SQUARE_WEBHOOK_SIGNATURE_KEY","description":"Signature key of the webhook subscription","secret":true,"from_step":"webhook"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Prohibited businesses","text":"Square's Payment Services may not be used for, among others, illegal goods and paraphernalia, credit repair, identity theft protection, direct marketing or subscription offers, remote pharmacies, unauthorised MLM, telemarketing, prepaid phone cards, bill payment services, betting and lotteries, cash disbursements, prepaid cards and financial merchandise, money orders and foreign currency, adult entertainment, firearms and weapons, remote sale of age-restricted products, occult materials, hate products and escort services.","source":"payment-terms"},{"kind":"rules_say","severity":"red","title":"Identity verification and underwriting","text":"Square reviews your sign-up to verify identity, may request a consumer report and further reports later, and shares your application with bank partners, who or Square may decide you cannot use the services.","source":"payment-terms"},{"kind":"rules_say","severity":"amber","title":"The seller carries chargebacks and reserves","text":"You are responsible for chargebacks on your account. Square may hold chargeback amounts, delay payouts, and require a reserve or withhold funds if your business is risky.","source":"payment-terms"},{"kind":"rules_say","severity":"amber","title":"OAuth is required for other sellers' accounts","text":"If your service lets Square sellers access their content, they must log in through OAuth, and you must not solicit or store Square passwords. Multi-tenant apps should use OAuth access tokens in production.","source":"developer-terms"},{"kind":"rules_say","severity":"amber","title":"App fees, taxes and disputes are on you","text":"If you collect fees from sellers through Square APIs you must describe them clearly and get consent. You are responsible for your indirect taxes and for disputes between you and sellers using your service.","source":"developer-terms"},{"kind":"rules_say","severity":"yellow","title":"Access prohibitions","text":"You may not resell Square's developer tools, build a service that duplicates Square or migrates sellers away from Square, or use Square data to train or enhance an AI system.","source":"developer-terms"},{"kind":"rules_say","severity":"yellow","title":"Personal access token has full access","text":"A personal access token can impersonate the account owner; redact it when sharing code or logs.","source":"access-tokens"}],"renewals":[{"what":"OAuth access tokens for sellers","every":"30 days","every_days":30,"source":"oauth"}],"pricing_notes":{"free_tier":"The developer account and Square Sandbox are free.","notes":"Payment processing fees for sellers are set by Square's pricing pages and Payment Terms and were not captured. [to verify]","source":"sandbox"},"stripe_projects":false,"api_provisioning":{"available":"no","notes":"Applications and their credentials are created by hand in the Developer Console; seller OAuth tokens come from the OAuth API after seller consent.","docs":["https://developer.squareup.com/docs/build-basics/access-tokens"],"source":"access-tokens"},"notes":["Terms quoted are the US versions; other countries have their own Payment Terms.","Whether a production personal access token works before seller activation was not confirmed. [to verify]","Activation fields (tax ID, SSN or EIN, business type) were not read from an official page. [to verify]"]}}