verapli
Sign inJoin free
Menu

Guides · payments · Popular APIs

Square Developer (API access)

Free Square developer account and application with separate Sandbox and production access tokens. Taking real payments needs an activated, identity-verified Square seller account; apps for other sellers must use OAuth.

Researched · not yet run liveLast researched 25 October 2026 · Square · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

A Square account holds one or more applications in the Developer Console. Each application has a Sandbox and a production environment with separate credentials. A personal access token acts on your own Square account; OAuth tokens act on other sellers' accounts.

  • Square account (developer) developer owned by the personFree to create.
  • Application project · under Square account (developer)Created in the Developer Console; has a Sandbox and a production side.
  • Sandbox test seller account otheroptional · under ApplicationEach test account has its own Sandbox Square Dashboard.
  • Activated Square seller account organisationoptional owned by the businessNeeded only to take real payments in production on your own account.

Credentials and resources from one environment cannot be used in the other.

Apps that serve many sellers should use OAuth access tokens in production.

Have ready

  • Email address for the Square account [1]Needed for: Create a Square developer account and first application
  • Identity details for the seller (Square may request identity-verifying information and a consumer report) · Square reviews sign-up information to verify that you are you and shares the application with bank partners. [6]Needed for: Activate your Square account for real payments
  • An ACH-enabled bank account in the seller's name (US) · You must link an ACH-enabled bank account or request a check to receive proceeds. [6]Needed for: Activate your Square account for real payments
  • Business tax details for activation [to verify exact fields] [6]Needed for: Activate your Square account for real payments

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create a Square developer account and first application

    You sign up yourself, agree to Square's terms, and enter your business name and an application name. Square then opens the new application in the Developer Console.

    • Guided by hand
    • Human step: You accept the terms

    Where: https://developer.squareup.com/

  2. Copy the Sandbox access token

    Open the application, choose Sandbox at the top, open Credentials and copy the Sandbox access token. Use it with https://connect.squareupsandbox.com.

    • Guided by hand
    • Human step: You sign in
    • After: Create a Square developer account and first application

    verapli captures SQUARE_SANDBOX_ACCESS_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    Where: https://developer.squareup.com/

  3. Note the application ID

    Copy the application ID from the application's Credentials page; OAuth token requests need it. [to verify exact page]

    • Guided by hand
    • After: Create a Square developer account and first application

    verapli captures SQUARE_APPLICATION_ID here by plain code: encrypted in your browser, never shown to AI.

    Where: https://developer.squareup.com/

  4. Activate your Square account for real payments

    Before taking payments in production, activate the Square account at squareup.com/activation. Square underwrites the account and verifies identity, and its bank partners may decline it.

    • Guided by hand
    • Human step: You prove your identity
    • After: Create a Square developer account and first application

    Where: https://squareup.com/activation

  5. Copy the production personal access token

    In Credentials, choose Production, then Show, and copy the token. It gives full access to your own Square account; use it only for your own integration.

    • Guided by hand
    • Human step: You sign in
    • After: Create a Square developer account and first application

    verapli captures SQUARE_ACCESS_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    Where: https://developer.squareup.com/

  6. Set up OAuth for other sellers (multi-seller apps)optional

    Register an HTTPS redirect URL, build the authorisation URL, and exchange the returned code with ObtainToken. Codes expire after 5 minutes and access tokens after 30 days, so refresh them. Sellers must log in through OAuth; never ask for or store their Square passwords.

    • Guided by hand
    • Human step: You press submit
    • After: Note the application ID

    verapli captures SQUARE_APPLICATION_SECRET here by plain code: encrypted in your browser, never shown to AI.

  7. Subscribe to webhooks (optional)optional

    Create a webhook subscription in the Developer Console and copy its signature key to validate x-square-hmacsha256-signature.

    • Guided by hand
    • Human step: You press submit
    • After: Create a Square developer account and first application

    verapli captures SQUARE_WEBHOOK_SIGNATURE_KEY here by plain code: encrypted in your browser, never shown to AI.

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Prohibited businesses

Square's Payment Services may not be used for, among others, illegal goods and paraphernalia, credit repair, identity theft protection, direct marketing or subscription offers, remote pharmacies, unauthorised MLM, telemarketing, prepaid phone cards, bill payment services, betting and lotteries, cash disbursements, prepaid cards and financial merchandise, money orders and foreign currency, adult entertainment, firearms and weapons, remote sale of age-restricted products, occult materials, hate products and escort services. [6]

Can get you bannedThe rules say

Identity verification and underwriting

Square reviews your sign-up to verify identity, may request a consumer report and further reports later, and shares your application with bank partners, who or Square may decide you cannot use the services. [6]

Can cost moneyThe rules say

The seller carries chargebacks and reserves

You are responsible for chargebacks on your account. Square may hold chargeback amounts, delay payouts, and require a reserve or withhold funds if your business is risky. [6]

Can cost moneyThe rules say

OAuth is required for other sellers' accounts

If your service lets Square sellers access their content, they must log in through OAuth, and you must not solicit or store Square passwords. Multi-tenant apps should use OAuth access tokens in production. [7]

Can cost moneyThe rules say

App fees, taxes and disputes are on you

If you collect fees from sellers through Square APIs you must describe them clearly and get consent. You are responsible for your indirect taxes and for disputes between you and sellers using your service. [7]

Worth knowingThe rules say

Access prohibitions

You may not resell Square's developer tools, build a service that duplicates Square or migrates sellers away from Square, or use Square data to train or enhance an AI system. [7]

Worth knowingThe rules say

Personal access token has full access

A personal access token can impersonate the account owner; redact it when sharing code or logs. [2]

What you end up with

Env varSecretFormatWhat it is
SQUARE_APPLICATION_IDnot secretApplication ID of the Square application
SQUARE_SANDBOX_ACCESS_TOKENsecretSandbox access token (connect.squareupsandbox.com)
SQUARE_ACCESS_TOKENsecretProduction personal access token for your own Square account (connect.squareup.com)
SQUARE_APPLICATION_SECRETsecretOAuth application secret used with the code flow [to verify location in the console]
SQUARE_WEBHOOK_SIGNATURE_KEYsecretSignature key of the webhook subscription

Renewals

  • OAuth access tokens for sellers: every 30 days [4]

Pricing

  • Free tier: The developer account and Square Sandbox are free.
  • Payment processing fees for sellers are set by Square's pricing pages and Payment Terms and were not captured. [to verify]

Source [3]

For agents

The same entry as JSON: /api/v1/entries/square/developer · requirements /api/v1/requirements/square/developer · terms /api/v1/terms/square/developer.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Square Developer (API access), and how long will it take?"
  → tools/call requirements { "provider_id": "square/developer" }

Sources

  1. Square Developer – Create an Account and Application Free developer account; sign-up collects name, email, password, country, business name and application name and requires agreeing to Square's terms; production payments need account activation at squareup.com/activation · accessed 25 October 2026 · official
  2. Square Developer – Access tokens Personal vs OAuth access tokens; each application has a production personal access token and a separate Sandbox token on the Credentials page; multi-tenant apps should use OAuth in production; Webhook Subscriptions and Events APIs need the personal access token · accessed 25 October 2026 · official
  3. Square Developer – Square Sandbox Free, isolated Sandbox per application; Sandbox and production base URLs; credentials do not work across environments · accessed 25 October 2026 · official
  4. Square Developer – OAuth API Code and PKCE flows; HTTPS redirect URL (localhost HTTP allowed in Sandbox); codes expire after 5 minutes; access tokens expire after 30 days; refresh token rules · accessed 25 October 2026 · official
  5. Square Developer – Verify and validate an event notification x-square-hmacsha256-signature header; signature key and notification URL under Webhooks in the Developer Console · accessed 25 October 2026 · official
  6. Square Payment Terms (US) Prohibited businesses list; underwriting and identity verification including consumer reports; seller liability for chargebacks; reserves and withheld payouts · accessed 25 October 2026 · official
  7. Square Developer Terms of Service (last updated 10 September 2026) Sellers must log in via OAuth and you must not solicit or store Square passwords; app-fee collection rules and agency; you handle your indirect taxes and disputes with sellers; access prohibitions including AI training on Square data · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Square is not affiliated with verapli.