Not sure why I’m getting this response when calling the order api and how to resolve it:
{“errors”: [{“code”: “FORBIDDEN”,“detail”: “Cannot fetch orders for a different merchant.”,“category”: “AUTHENTICATION_ERROR”}]} - - "{"errors": [{"code": "FORBIDDEN","detail": "Cannot fetch orders for a different merchant.","category": "AUTHENTICATION_ERROR"}]}
Please help, thanks.
I’m Square Dev AI, here to help answer your question!
Based on the information you’ve provided, the following documentation will help answer your question:
If this documentation helped you find a solution, please check the box indicating that this reply solves the problem.
Otherwise one of our Developer Advocates will provide additional assistance shortly.
The error message “Cannot fetch orders for a different merchant” indicates that the access token you’re using in your API call is not authorized to access orders for the merchant ID you’re trying to fetch. This usually happens when the access token is associated with a different merchant account than the one you’re trying to access.
To resolve this issue, ensure that you’re using the correct access token for the merchant account whose orders you’re trying to fetch. If you’re using OAuth, make sure that the merchant has granted your application the necessary permissions to access their orders.
This answer was reviewed by @Bryan-Square.
The issue here is that, this error happened on the square side by one of the people who is reviewing my app.
Initially it worked for them when they tested it a week ago but now it seems that they have changed the account they are using to test my app and this error started to happening.
so not sure how to debug it. Is there a way to connect from the team who is reviewing my app?
What is your app doing? Is it trying to get an order from another Square account? The authorization can only get objects from the Square account it’s connected to. 
Not sure what am I missing but here are some details about the issue.
I have two sandbox accounts:
Steps:
Hope you give me some directions that I can work on during the weekend.
Thanks
Is feels like my computer or browser has been authorized to my default sandbox account only and cannot be changed to use another account(s).
The access token works every time for my default sandbox account every time I try to revoke its access token and re-authenticate again. Yet it never works when I try to connect it and authenticate it to another sandbox account like my seller sandbox account.
What exactly am I missing here? please let me know.
I believe there is some confusion with the OAuth process and how sandbox test accounts work. The Default test account is designed to work with your access token. There is no need to OAuth to that account. Your other test account you’ll want to OAuth to that and use the generated access token to make API calls on the accounts behalf.
Your Square developer account comes with a default test account in the Sandbox. To simulate third-party application development, you need to create a second Sandbox account to act as a seller account.
In the Sandbox, the seller must be signed in to see the Square authorization page. Sign in to a seller test account by opening the Seller Dashboard. In production, you can also control whether you force the seller to sign in explicitly by setting the session parameter to false (recommended).
Thanks for the feedback.
I’ve been doing exactly what you have recommended.
I have a “second / seller account” which I sign in to by clicking on its dashboard then I try to authenticate it. It works just fine, It takes me to the “Allow / Deny” auth page. I click on “Allow” and I get the access token back with the new seller account merchant id which is in this case “MLWQJSXSSYF8F”. But it doesn’t work and keeps failing with the same error msg “different location error”.
Would you like me to share the access token here?
What API call are you getting the error with?
orders api
https://connect.squareupsandbox.com’ + ‘/v2/orders/’ + orderId
And the same happened for the person who was reviewing my app when calling the other production end point:
‘https://connect.squareup.com’ + ‘/v2/orders/’ + orderId;
What’s the order_id?
Here is webhook json which includes the merchant-id and order-id:
order id = x7RmcEbRCOApLidafl68j5NAm4IZY
{“merchant_id”:“MLWQJSXSSYF8F”,“type”:“order.created”,“event_id”:“41d6871d-62ba-3017-a884-16638b755005”,“created_at”:“2024-09-03T17:38:47Z”,“data”:{“type”:“order_created”,“id”:“x7RmcEbRCOApLidafl68j5NAm4IZY”,“object”:{“order_created”:{“created_at”:“2024-09-03T17:38:46.678Z”,“location_id”:“L417Y9QWTC4NV”,“order_id”:“x7RmcEbRCOApLidafl68j5NAm4IZY”,“state”:“OPEN”,“version”:1}}}}
and here is the order api response:
{“errors”: [{“code”: “FORBIDDEN”,“detail”: “Cannot fetch orders for a different merchant.”,“category”: “AUTHENTICATION_ERROR”}]}
The access token that your using to get the order does is it for that same merchant_id? You can check with RetrieveTokenStatus. If it doesn’t match then the access token your using is for another account and you’ll need to use the access token that matches the merchant_id in the webhook body.
ok thanks. that was confusing to let the default access token works all the times.
Please don’t share access tokens they are secret. Anyway’s I got it to work when calling RetrieveOrder. With that access token. When I checked your API Logs I see that the request is coming from a different merchant_id. So that means that the access token that’s being passed to Square isn’t the correct one.
Failed request:
Successful request:
got it, clear now. thanks.
