# Customers created via API with creation\_source: THIRD\_PARTY that I didn't create — no CreateCustomer calls in my app's API Logs **URL:** \ **Category:** Questions\ **Created:** [September 2, 2026, 12:47am UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450 "2026-09-02T00:47:50Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![botanicalaesthetics](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@botanicalaesthetics](https://developer.squareup.com/forums/u/botanicalaesthetics)\ **Post date:** [September 2, 2026, 12:47am UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450/1 "2026-09-02T00:47:50Z")
I own a Square Developer application (a client-management app for estheticians). Over the past several days, hundreds of customers I did not create keep appearing in my **production** Customer Directory, and the count climbs by ~60/day. I need help finding what’s creating them. **The fake customers are clearly generated test data:** - Reserved fictional phone numbers: US `(734) 555-0100` and UK `+44 20 7946 0958` - Randomly generated emails, e.g. `cecil.burch29fc@icloud.com` (name + random suffix) - Realistic but fake names - Visits: 0, Last visited: Never - `creation_source: THIRD_PARTY` **What I’ve already checked:** - Only **one** application is authorized on my account (mine) - In my application’s **Production API Logs** , under the Customers API I see only `ListCustomers`, `RetrieveCustomer`, and `DeleteCustomer` — there are **zero `CreateCustomer` calls** across the entire date range. Yet customers keep being created with `creation_source: THIRD_PARTY`. - I’ve **rotated my Production Access Token several times** — the customers keep appearing afterward, so it doesn’t appear to be that token. - These are in **production** , not sandbox. I have only **one location**. **My questions:** 1. If a customer shows `creation_source: THIRD_PARTY`, some app called `CreateCustomer`. How do I find **which application ID / access token** made those calls, when they don’t appear in my own app’s API Logs? 2. Why would `CreateCustomer` calls **not appear** in my application’s API Logs — does that view exclude Personal/Production Access Token calls, or calls from an authorization I can’t see? 3. Rotating my Production Access Token repeatedly hasn’t stopped it. What other credential or authorization could still be writing to my Customer Directory, and how do I revoke it? 4. Is there a way for me to see the **complete list of tokens/authorizations** that currently have write access to my Customer Directory? This is my live business account, so the junk data is a real problem. Any help identifying and cutting off the source would be hugely appreciated. Thank you! ---
**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\ **Post date:** [September 2, 2026, 7:46pm UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450/4 "2026-09-02T19:46:53Z")
Hi @botanicalaesthetics! API Logs in the Developer Console are application-scoped — they only show calls made with tokens belonging to that specific application. If another application (or a different OAuth token) is creating these customers, those calls won’t appear in your app’s logs. Rotating your PAT would not disconnect any third-party apps that are connected to your merchant account. If you have an app that has OAuth access to your account, it would still be able to create customers in your account without leaving any API logs in your application. The first thing I would check is your authorized apps: Go to **Square Dashboard → Settings → App Integrations → My Applications**. Disconnect anything you don’t recognize. If that doesn’t resolve the issue, please share your App ID and we can conduct further investigation internally. ---
**Author:** ![botanicalaesthetics](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@botanicalaesthetics](https://developer.squareup.com/forums/u/botanicalaesthetics)\ **Post date:** [September 2, 2026, 9:41pm UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450/5 "2026-09-02T21:41:25Z")
Thank you — that clears up why the CreateCustomer calls weren’t in my logs. I’ve already checked Dashboard → Settings → App Integrations → My Applications. The only app listed is **my own custom app, SlickChart** — and Square won’t let me revoke a custom app I created from that page. There’s nothing else there that I don’t recognize. Since I can’t find or disconnect the source myself, could you please investigate internally? Specifically: 1. On my merchant ( **MLJ6ACV37VWQ0** ), which **application ID / OAuth token** is calling `CreateCustomer`? These are fake/generated records — reserved fictional numbers like `(734) 555-0100` and `+44 20 7946 0958`, randomized emails, 0 visits, ~60 per day. 2. How do I **revoke** that application’s OAuth access, given it doesn’t appear in my App Integrations list? 3. Can you show me **all OAuth authorizations** currently able to write to my Customer Directory, so I can confirm exactly what has access? My App ID: **sq0idp-kiUnqYIaeYeI3\_RCEDptog** This is my live business account, so I really appreciate the help. ---
**Author:** ![botanicalaesthetics](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@botanicalaesthetics](https://developer.squareup.com/forums/u/botanicalaesthetics)\ **Post date:** [September 2, 2026, 10:06pm UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450/6 "2026-09-02T22:06:08Z")
Thank you — the detail about API Logs being application-scoped was the key that unlocked this. It led me to several “Solved” community threads describing this exact issue. It turns out these fake `THIRD_PARTY` customers are being created by **bots spamming a Square website form on my site** — specifically my **email signup / newsletter subscription form** on Square Online — not by my own application. Every fake profile is tagged **“Email subscribed” / Email Subscribers** , has reserved fictional phone numbers (US `555-0100`, UK `+44 20 7946 0958`), a randomized email, and **0 visits, no bookings, and no charges** (my online booking requires a deposit, so no fake bookings came through, and I have no suspicious payments). So this is junk signups, not payment fraud. Two things I’d appreciate help with: 1. **Locking down the source:** what’s the best way to stop bot submissions to my Square Online **email signup form** — disabling it, adding CAPTCHA, or any spam protection you’d recommend? Can you confirm from your side that these customers are coming from that signup widget and not another application? 2. **Cleaning up the mess:** I now have **hundreds** of these fake customers (grown from ~800 to 910+ in a day), and the dashboard gives me no way to bulk-filter and remove them. Could you help me **bulk-delete all customers created in the last ~week** matching this pattern — fictional phone numbers (`555-0100`, `+44 20 7946 0958`), randomized emails, `creation_source: THIRD_PARTY`, Email Subscriber, 0 visits? If you can purge them in bulk on your end, or give me a safe filter/query, that would save an enormous amount of manual work. Thanks again for the pointer in the right direction. * * * ---
**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\ **Post date:** [September 3, 2026, 4:23pm UTC](https://developer.squareup.com/forums/t/customers-created-via-api-with-creation-source-third-party-that-i-didnt-create-no-createcustomer-calls-in-my-apps-api-logs/27450/7 "2026-09-03T16:23:56Z")
@botanicalaesthetics - As an immediate next step, I recommend temporarily removing or disabling the signup form and monitoring whether new profiles stop appearing. Square Online’s newsletter signup form does not currently provide a CAPTCHA, email-verification, or double-opt-in setting. For cleanup, the Customers API provides a [BulkDeleteCustomers](https://developer.squareup.com/reference/square/customers-api/bulk-delete-customers) endpoint that deletes up to 100 customer IDs per request. You can use [SearchCustomers](https://developer.squareup.com/reference/square/customers-api/search-customers) to identify candidates by creation date, THIRD\_PARTY creation source, phone number, and Email Subscribers group membership, then perform any additional validation in your script before submitting the IDs in batches. Please carefully review the candidate list first. Customer deletion is permanent and can affect related Square records, so I would not delete profiles based only on their creation source or date. If new profiles continue after the newsletter forms are removed, please let us know so the source can be investigated further.