With respect to saving the card for a later transaction (or two), you’d need to use the supplied token to save a card ID. The steps in rough summary are:
- get customer to submit a card token and providing their details (name, phone, address etc)
- create a Square customer using Square API CreateCustomer call
- save a card using Square API call CreateCard and the token from the customer
- when ready, use the saved card token and the API call CreatePayment to charge the card
The whole process, including charging the card, is beautifully documented in complete detail here:
https://developer.squareup.com/docs/cards-api/walkthrough-seller-card
It might be good to do a pre-auth as well, not sure about the importance of that within your legal constraints, but it does allow you to verify the card more completely and remind the customer that your payment is coming up. It also reserves funds, which may be problematic if it’s a whole week away. Either way my understanding is that you’d need to communicate clearly with the customer as to what was happening (card is being saved, amount, pre-auth if done, emailing them re this as well, email when card charged and potentially before the card charge). This is partly because some places require this, partly to avoid misunderstandings/chargebacks.
Feel free to let me know if I’ve got any of this wrong, not sure where one would go to read what the requirements are in different legal jurisdictions.