Authorization

How it Works: The Mobile Authorization API

Request authorization tokens to initialize Square mobile solutions like Reader SDK.

Android
iOS
Backend
Mobile Authorization API

Related Products

Mobile Authorization API process flow
Permalink Get a link to this section

The Mobile Authorization API accepts an account credential (OAuth token or Personal Access Token) and location ID and returns an authorization code that custom mobile apps can use to initialize Square mobile solutions like Reader SDK to accept payments using Square hardware. In general, requesting a mobile authorization code involves the following steps:

  1. The mobile app calls the custom authorization service.

  2. The authorization service completes the Square OAuth flow and obtains a valid OAuth token.

  3. The authorization service uses the Locations API to call the ListLocations endpoint and gather a list of locations associated with the target account.

  4. The authorization service API selects a target Location ID programmatically or with a web UI.

  5. The authorization service calls CreateMobileAuthorizationCode with the OAuth token and selected Location ID.

  6. The authorization service returns a mobile authorization code to the mobile app.

mobileauthz-process-flow

Did you know?

Mobile authorization codes are short lived and should be used immediately to authorize mobile solutions like Reader SDK. Mobile authorization does not expire after a set amount of time. Authorization remains valid unless it is explicitly revoked (for example, by calling deauthorize in Reader SDK) or the authorized application fails to take a payment within 90 days.