How it Works: The Mobile Authorization API
Request authorization tokens to initialize Square mobile solutions like Reader SDK.
On this page
The Mobile Authorization API accepts an account credential (OAuth token or Personal Access Token) and location ID and returns an authorization code that custom mobile apps can use to initialize Square mobile solutions like Reader SDK to accept payments using Square hardware. In general, requesting a mobile authorization code involves the following steps:
The mobile app calls the custom authorization service.
The authorization service completes the Square OAuth flow and obtains a valid OAuth token.
The authorization service uses the Locations API to call the ListLocations endpoint and gather a list of locations associated with the target account.
The authorization service API selects a target Location ID programmatically or with a web UI.
The authorization service calls CreateMobileAuthorizationCode with the OAuth token and selected Location ID.
The authorization service returns a mobile authorization code to the mobile app.
Did you know?
Mobile authorization codes are short lived and should be used immediately to
authorize mobile solutions like Reader SDK. Mobile authorization does not expire
after a set amount of time. Authorization remains valid unless it is explicitly
revoked (for example, by calling
deauthorize in Reader SDK) or the authorized
application fails to take a payment within 90 days.