Square integrations by platform

Sandbox run evidence

UAT-Ops ran the directory's canonical card flow against Square's sandbox on 2026-09-11: 6 passed. Every request went to the real sandbox through the workbench's ordinary execution path. Keys, object ids, request and response bodies were removed before publication; the status word in the last column is the provider's own.

Platform pages

• WooCommerce Official plugin

What we checked

• A Sandbox is created automatically when an application is registered in the Developer Console; Sandbox use is free with unlimited API calls, and Sandbox requests go to connect.squareupsandbox.com rather than connect.squareup.com.¹
• Developers can create up to 10 Sandbox test accounts beyond the default one, each in any country where Square processes payments, and simulated payments follow that country's banking rules.¹
• In the Sandbox Square Dashboard, refunds can be viewed but not issued, receipts are not generated, and subscriptions cannot be viewed or edited.¹
• Sandbox test values include the payment token cnon:card-nonce-ok for a successful card payment, tokens for rejected CVV, postal code, expiration and declines, test card numbers such as Visa 4111 1111 1111 1111 with CVV 111, and tokens for ACH (bnon:bank-nonce-ok), Afterpay/Clearpay (wnon:afterpay-or-clearpay-ok) and Cash App Pay (wnon:cash-app-ok).²
• A Sandbox ACH payment starts as PENDING and moves to COMPLETED after one minute, whereas production ACH can take two to three business days and is US-only.³
• A RefundPayment response can carry status PENDING while Square processes it; most refunds complete within hours and card refunds can stay PENDING for up to 14 days. Partial refunds against one Payment are supported, up to 20 refunds per payment and only within one year of the original payment.⁴
• CreatePayment requires an idempotency_key (max length 45) and a source_id, and the amount_money currency must match the currency of the business taking the payment. An optional verification_token from the buyer-verification step carries the 3-D Secure result.⁵
• Square API operations accept a unique idempotency key string so an accidental duplicate call does not create a second payment or record.⁶
• Square API versions are named by release date (YYYY-MM-DD) and selected per request with the Square-Version header; when the header is omitted the application's default version from the Developer Console applies, responses echo the version used, and releases are typically monthly.⁷
• Webhook subscriptions are configured in the Developer Console or through the Webhook Subscriptions API with a notification URL and a list of event types; undelivered events are retried with exponential backoff for up to 24 hours, and Sandbox webhooks originate from different IP addresses than production.⁸
• Each webhook notification carries an x-square-hmacsha256-signature header, an HMAC-SHA256 over the notification URL plus raw request body using the subscription's signature key from the Developer Console; the official SDKs ship a WebhooksHelper that verifies it.⁹
• Square publishes the OpenAPI/Swagger specification of its API (api.json) in the official square/connect-api-specification GitHub repository, which is also the source for generating the official SDKs.¹⁰
• The official Square Node.js/TypeScript SDK supports Node 18+ and is generated programmatically; the API version can be overridden per request with a version option.¹¹
• The Payments API accepts card, gift card, Apple Pay, Google Pay, Cash App Pay, Afterpay/Clearpay and ACH bank transfer sources, supports authorize-then-complete delayed capture, and can charge cards on file.¹²
• The Web Payments SDK tokenizes cards, Apple Pay, Google Pay, Cash App Pay, Afterpay/Clearpay, ACH and gift cards in the browser into single-use tokens that the Payments API accepts as source_id; in the EU, a payment without buyer verification fails with CARD_DECLINED_VERIFICATION_REQUIRED when authentication is required.¹³
• Square directs developers operating in the EEA, the UK and Japan to implement Strong Customer Authentication through its buyer-verification step, which uses 3-D Secure.¹⁴
• The Cards API stores credit and debit cards on file for later payments, runs a zero-amount verification when a card is saved, requires buyer permission before saving, and Square manages network tokenization for Visa, Mastercard and American Express automatically.¹⁵
• The Subscriptions API charges a stored payment method on a recurring schedule from catalog subscription plans, supports phases such as free trials, and does not support ACH because bank accounts cannot be stored and charged later.¹⁶
• Square APIs process payments for sellers in eight countries: the United States, Canada, the United Kingdom, Australia, Japan, Ireland, France and Spain; sellers elsewhere can only record external and cash payments.¹⁷
• Apple Pay and Google Pay are available in all eight supported countries; Afterpay in the US, Canada and Australia and Clearpay in the UK; ACH and Cash App Pay only in the US; Ireland, France and Spain have cards and wallets only.¹⁸
• Payments are processed in the seller location's currency, read from the Locations API; a Square account operates in one currency, so collecting in several currencies means a separate Square account per region.¹⁹
• Square's developer pricing page lists Web Payments SDK and Payments API card-not-present payments at 2.9% + 30 cents in the US (2.8% + 30 cents Canada, 1.4% + 25p UK cards), US in-person at 2.6% + 15 cents, ACH at 1% with a $1 minimum and $5 maximum, Afterpay at 6% + 30 cents, and a 1.5% surcharge for cards issued outside the seller's country.²⁰
• Square's US fee article lists eCommerce API payments at 2.9% + 30 cents on every plan, manually keyed and card-on-file payments at 3.5% + 15 cents, and invoices at 3.3% + 30 cents on the free plan.²¹

Sources

1. https://developer.squareup.com/docs/devtools/sandbox/overviewofficial documentation · checked 2026-09-11
2. https://developer.squareup.com/docs/devtools/sandbox/paymentsofficial documentation · checked 2026-09-11
3. https://developer.squareup.com/docs/payments-api/take-payments/ach-paymentsofficial documentation · checked 2026-09-11
4. https://developer.squareup.com/docs/payments-api/refund-paymentsofficial documentation · checked 2026-09-11
5. https://developer.squareup.com/reference/square/payments-api/create-paymentofficial documentation · checked 2026-09-11
6. https://developer.squareup.com/docs/build-basics/common-api-patterns/idempotencyofficial documentation · checked 2026-09-11
7. https://developer.squareup.com/docs/build-basics/versioning-overviewofficial documentation · checked 2026-09-11
8. https://developer.squareup.com/docs/webhooks/overviewofficial documentation · checked 2026-09-11
9. https://developer.squareup.com/docs/webhooks/step3validateofficial documentation · checked 2026-09-11
10. https://github.com/square/connect-api-specificationcode repository · checked 2026-09-11
11. https://github.com/square/square-nodejs-sdkcode repository · checked 2026-09-11
12. https://developer.squareup.com/docs/payments-api/overviewofficial documentation · checked 2026-09-11
13. https://developer.squareup.com/docs/web-payments/overviewofficial documentation · checked 2026-09-11
14. https://developer.squareup.com/docs/sca-overviewofficial documentation · checked 2026-09-11
15. https://developer.squareup.com/docs/cards-api/overviewofficial documentation · checked 2026-09-11
16. https://developer.squareup.com/docs/subscriptions-api/overviewofficial documentation · checked 2026-09-11
17. https://developer.squareup.com/docs/international-developmentofficial documentation · checked 2026-09-11
18. https://developer.squareup.com/docs/payment-card-support-by-countryofficial documentation · checked 2026-09-11
19. https://developer.squareup.com/docs/international-development/paymentsofficial documentation · checked 2026-09-11
20. https://developer.squareup.com/docs/payments-pricingvendor pricing page · checked 2026-09-11
21. https://squareup.com/help/us/en/article/5068-what-are-square-s-feesvendor pricing page · checked 2026-09-11