# Create\_Payment\_Link and LocationID of seller

**URL:** <https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095>\
**Category:** Questions\
**Tags:** payments-api, checkout-api, locations-api\
**Created:** [February 7, 2024, 1:32am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095 "2024-02-07T01:32:07Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheLeedz](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/theleedz/32/2680_2.png) [@TheLeedz](https://developer.squareup.com/forums/u/TheLeedz)\
**Post date:** [February 7, 2024, 1:32am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095/1 "2024-02-07T01:32:07Z")

</div>

**SCENARIO**  
[theleedz.com](http://theleedz.com/) brokers the payment of a digital asset from Buyer → Seller with the app taking a small fee. In the scenario provided the seller is ‘scott.gross’ and the buyer is ‘theleedz’ – an admin accounts up just like any other user. I have two Square accounts – two white cards one for scott.gross and one for theleedz. I have tested it both ways - with either party being buyer/seller.

**SANDBOX**  
In the sandbox I was able authorize both accounts and generate access/refresh tokens. In the sandbox I can create a payment link and proceed through to the sample payment dialog with the caveat that to proceed further, to test app fee etc., I would need to switch to production.

I switched to production – create\_payment\_link is broke.

**TESTING**

SELLER  
scott.gross  
ACCESS TOKEN:

BUYER  
theleedz  
ACCESS TOKEN:

**AWS**

APP: My app is sending the following request – this is taken right from AWS logs:  
URL: [POST /v2/online-checkout/payment-links - Square API Explorer](https://developer.squareup.com/explorer/square/checkout-api/create-payment-link)

HEADER  
{‘Accept’: ‘application/json’, ‘Square-Version’: ‘2023-12-13’, ‘Authorization’: ‘Bearer ACCESS\_TOKEN’, ‘Content-Type’: ‘application/json’}

BODY  
{“checkout\_options”: {“app\_fee\_money”: {“currency”: “USD”, “amount”: 18}, “redirect\_url”: “[https://theleedz.com/hustle.html”](https://theleedz.com/hustle.html%E2%80%9D), “merchant\_support\_email”: “[theleedz.com@gmail.com](mailto:theleedz.com@gmail.com)”, “ask\_for\_shipping\_address”: “false”}, “quick\_pay”: {“location\_id”: “L40JHVTYW8QZW”, “name”: “scott’s airbrush 2/20”, “price\_money”: {“currency”: “USD”, “amount”: 200}}, “description”: “[airbrush] scott’s airbrush 2/20 (90034)”, “payment\_note”: “151882451|airbrush|theleedz”}’

The result is HTTP ERROR 400 Bad Request

**WEB CLIENT**

> **[POST /v2/online-checkout/payment-links - Square API Explorer](https://developer.squareup.com/explorer/square/checkout-api/create-payment-link)**
>
> Try out the CreatePaymentLink endpoint in Square's API Explorer

curl [https://connect.squareup.com/v2/online-checkout/payment-links](https://connect.squareup.com/v2/online-checkout/payment-links)  
-X POST  
-H ‘Square-Version: 2024-01-18’  
-H ‘Authorization: Bearer ACCESS TOKEN’  
-H ‘Content-Type: application/json’  
-d ‘{  
“quick\_pay”: {  
“location\_id”: “L40JHVTYW8QZW”,  
“name”: “Sample Caricature Party Sample”,  
“price\_money”: {  
“amount”: 200,  
“currency”: “USD”  
}  
},  
“payment\_note”: “62732928|caricatures|scott.gross”,  
“description”: “[caricatures] Sample Caricature Party Sample (90034)”,  
“checkout\_options”: {  
“app\_fee\_money”: {  
“amount”: 18,  
“currency”: “USD”  
},  
“redirect\_url”: “[https://theleedz.com/hustle.html”](https://theleedz.com/hustle.html%E2%80%9D),  
“merchant\_support\_email”: “[theleedz.com@gmail.com](mailto:theleedz.com@gmail.com)”,  
“ask\_for\_shipping\_address”: false  
}  
}’

**------ RESPONSE ------**

cache-control: no-cache  
content-length: 119  
content-type: application/json  
date: Tue, 06 Feb 2024 23:18:06 GMT  
square-version: 2024-01-18

{  
“errors”: [  
{  
“category”: “INVALID\_REQUEST\_ERROR”,  
“code”: “INVALID\_VALUE”,  
“detail”: “Invalid location id: L40JHVTYW8QZW.”  
}  
]  
}

\*\*\*\*\*\*\*\*\*\* IF I replace the seller’s token with the buyer’s token – it works!\*\*

curl [https://connect.squareup.com/v2/online-checkout/payment-links](https://connect.squareup.com/v2/online-checkout/payment-links)  
-X POST  
-H ‘Square-Version: 2024-01-18’  
-H ‘Authorization: Bearer ACCESS\_TOKEN’  
-H ‘Content-Type: application/json’  
-d ‘{  
“quick\_pay”: {  
“location\_id”: “L40JHVTYW8QZW”,  
“name”: “Sample Caricature Party Sample”,  
“price\_money”: {  
“amount”: 200,  
“currency”: “USD”  
}  
},  
“payment\_note”: “62732928|caricatures|scott.gross”,  
“description”: “[caricatures] Sample Caricature Party Sample (90034)”,  
“checkout\_options”: {  
“app\_fee\_money”: {  
“amount”: 18,  
“currency”: “USD”  
},  
“redirect\_url”: “[https://theleedz.com/hustle.html”](https://theleedz.com/hustle.html%E2%80%9D),  
“merchant\_support\_email”: “[theleedz.com@gmail.com](mailto:theleedz.com@gmail.com)”,  
“ask\_for\_shipping\_address”: false  
}  
}’

**PRODUCES**

{  
“payment\_link”: {  
“id”: “6OROXAQUJYERW2BJ”,  
“version”: 1,  
“description”: “[caricatures] Sample Caricature Party Sample (90034)”,  
“order\_id”: “HNUwrZ6MP9snpqzE8FSH8B6QYxCZY”,  
“checkout\_options”: {  
“redirect\_url”: “[https://theleedz.com/hustle.html”](https://theleedz.com/hustle.html%E2%80%9D),  
“merchant\_support\_email”: “[theleedz.com@gmail.com](mailto:theleedz.com@gmail.com)”,  
“ask\_for\_shipping\_address”: false,  
“app\_fee\_money”: {  
“amount”: 18,  
“currency”: “USD”  
}  
},  
“url”: “[https://square.link/u/oVcvJNDO”](https://square.link/u/oVcvJNDO%E2%80%9D),  
“long\_url”: “[https://checkout.square.site/merchant/MLT52FZYSY9GD/order/HNUwrZ6MP9snpqzE8FSH8B6QYxCZY”](https://checkout.square.site/merchant/MLT52FZYSY9GD/order/HNUwrZ6MP9snpqzE8FSH8B6QYxCZY%E2%80%9D),  
“created\_at”: “2024-02-06T23:19:32Z”,  
“payment\_note”: “62732928|caricatures|scott.gross”  
},  
“related\_resources”: {  
“orders”: [  
{  
“id”: “HNUwrZ6MP9snpqzE8FSH8B6QYxCZY”,  
“location\_id”: “L40JHVTYW8QZW”,  
“source”: {  
“name”: “The Leedz”  
},  
“line\_items”: [  
{  
“uid”: “EZqSNyEeMVyTOP1NlS4Lb”,  
“name”: “Sample Caricature Party Sample”,  
“quantity”: “1”,  
“item\_type”: “ITEM”,  
“base\_price\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“variation\_total\_price\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“gross\_sales\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“total\_tax\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“total\_discount\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“total\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“total\_service\_charge\_money”: {  
“amount”: 0,  
“currency”: “USD”  
}  
}  
],  
“fulfillments”: [  
{  
“uid”: “yr1vvNP6Ml2qJtU06QFZn”,  
“type”: “DIGITAL”,  
“state”: “PROPOSED”  
}  
],  
“net\_amounts”: {  
“total\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“tax\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“discount\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“tip\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“service\_charge\_money”: {  
“amount”: 0,  
“currency”: “USD”  
}  
},  
“created\_at”: “2024-02-06T23:19:32.662Z”,  
“updated\_at”: “2024-02-06T23:19:32.662Z”,  
“state”: “DRAFT”,  
“version”: 1,  
“total\_money”: {  
“amount”: 200,  
“currency”: “USD”  
},  
“total\_tax\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“total\_discount\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“total\_tip\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“total\_service\_charge\_money”: {  
“amount”: 0,  
“currency”: “USD”  
},  
“net\_amount\_due\_money”: {  
“amount”: 200,  
“currency”: “USD”  
}  
}  
]  
}  
}

ANALYSIS

[The Leedz](https://squareup.com/dashboard/locations/L40JHVTYW8QZW)(Main)

L40JHVTYW8QZW

**Location ID comes from the application developer console. It is associated with ‘theleedz’ because theleedz is a character in the scenario – but it would have no connection to two random users of the system. The checkout link ONLY works when the access token of the application – matching the LocationID – is encoded into the link.**

**This is a problem for me. The checkout link must be encoded with the seller’s info – not the buyer’s info. And not the app info. The seller is giving permission to the app to deposit the sale money into their Square account (and subtract the app fee). The buyer is brand new to the system and just paying for a digital asset with a credit card. They are providing all the required ‘authorization’ in the checkout dialog when they authorize payment. Although I store access/refresh tokens for the buyer when they sign up – that is only so they can then sell and collect money. It should be possible to use the system just by coming to the page and seeing a list of checkout links and buying one. There is no way to determine the locationID of a random buyer.**

+Scott

[theleedz.com](http://theleedz.com/)

---

<div class="post-metadata">

**Author:** ![TheLeedz](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/theleedz/32/2680_2.png) [@TheLeedz](https://developer.squareup.com/forums/u/TheLeedz)\
**Post date:** [February 7, 2024, 1:37am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095/2 "2024-02-07T01:37:18Z")

</div>

The create\_payment\_link API wants the LocationID of the seller matching the authorization token. I thought I might use the Location API

– I have the seller’s authorization token – just exchange it for the Location ID  
`[GET /v2/locations/{location\_id} - Square API Explorer](https://developer.squareup.com/explorer/square_2024-01-18/locations-api/retrieve-location)  
[https://connect.squareup.com/v2/locations/main](https://connect.squareup.com/v2/locations/main)

This generates the error

category": “AUTHENTICATION\_ERROR”,  
“code”: “INSUFFICIENT\_SCOPES”,  
“detail”: “The merchant has not given your application sufficient permissions to do that. The merchant must authorize your application for the following scopes: MERCHANT\_PROFILE\_READ”  
}

!! HOWEVER !! those permissions ARE granted during oauth – see Developer Dashboard Log:

REQUEST  
{  
“client\_id”: “sq0idp-fGPn-QZvqEnvGeWHA9sHMw”,  
“client\_secret”: “[redacted]”,  
“code”: “[redacted]”,  
“redirect\_uri”: “[User Editor](https://theleedz.com/user_editor.html?square=authorized)”,  
“grant\_type”: “authorization\_code”,  
“scopes”: [  
“ORDERS\_WRITE”,  
“ORDERS\_READ”,  
“PAYMENTS\_WRITE”,  
“PAYMENTS\_READ”,  
“PAYMENTS\_WRITE\_ADDITIONAL\_RECIPIENTS”,  
“MERCHANT\_PROFILE\_READ”  
]  
}

RESPONSE

200 – OK

{  
“access\_token”: “[redacted]”,  
“token\_type”: “bearer”,  
“expires\_at”: “2024-03-08T01:15:21Z”,  
“merchant\_id”: “516FB1QR33PFH”,  
“refresh\_token”: “[redacted]”,  
“short\_lived”: false  
}

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [February 7, 2024, 1:47am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095/3 "2024-02-07T01:47:02Z")

</div>

The `location_id` your passing in is `L40JHVTYW8QZW` which is for the Leedz account. The merchant\_id for the permissions your showing is for `516FB1QR33PFH` which is the scott.gross account. If your going to use that token you have to use a scott.gross `location_id` since that’s the OAuth’d account. 🙂

---

<div class="post-metadata">

**Author:** ![TheLeedz](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/theleedz/32/2680_2.png) [@TheLeedz](https://developer.squareup.com/forums/u/TheLeedz)\
**Post date:** [February 7, 2024, 1:57am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095/4 "2024-02-07T01:57:52Z")

</div>

How do I obtain the Location ID for ‘scottgross.works’ ?  
I have the authorization token.  
When the oauth was granted I asked for and received MERCHANT\_PROFILE\_READ

{  
“client\_id”: “sq0idp-fGPn-QZvqEnvGeWHA9sHMw”,  
“client\_secret”: “[redacted]”,  
“code”: “[redacted]”,  
“redirect\_uri”: “[User Editor](https://theleedz.com/user_editor.html?square=authorized)”,  
“grant\_type”: “authorization\_code”,  
“scopes”: [  
“ORDERS\_WRITE”,  
“ORDERS\_READ”,  
“PAYMENTS\_WRITE”,  
“PAYMENTS\_READ”,  
“PAYMENTS\_WRITE\_ADDITIONAL\_RECIPIENTS”,  
“MERCHANT\_PROFILE\_READ”  
]  
}

I went to  
-developer.squareup.com/explorer/square\_2024-01-18/locations-api/retrieve-location

I tried exchanging the auth token for the location ID but still got this ERROR  
“category”: “AUTHENTICATION\_ERROR”,  
“code”: “INSUFFICIENT\_SCOPES”,  
“detail”: “The merchant has not given your application sufficient permissions to do that. The merchant must authorize your application for the following scopes: MERCHANT\_PROFILE\_READ”

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [February 7, 2024, 2:07am UTC](https://developer.squareup.com/forums/t/create-payment-link-and-locationid-of-seller/12095/5 "2024-02-07T02:07:06Z")

</div>

With the access token for merchant\_id: `516FB1QR33PFH` you’ll call [ListLocations](https://developer.squareup.com/reference/square/locations-api/list-locations). 🙂