Getting the location id during OAuth

mubasharabbas · May 27, 2021, 6:43pm

Hi,

I am implementing the OAuth, and upon the success we get the authorization code, and the merchantId. We need the location id for which the app was authorized.

According to my understanding, a merchant can have multiple locations, so we would like to know the id of the location as well.
How can we authorize for a single location rather than the entire business.

Thankyou.

Bryan-Square · June 1, 2021, 3:18pm

Hi @mubasharabbas,

Yes, a merchant can have multiple locations with Square and once authorized you can call ListLocations to get all the existing locations. Currently the scope of access tokens is for they entire merchant account. They aren’t scoped to a single location.

wsadiq · June 1, 2021, 9:56pm

Hi Bryan,

What if a merchant has multiple locations but they want to purchase/install/authorize an app for only one of those locations? The app that we are migrating to Square currently is subscribed to on a per location basis. Is that doable in Square?

wsadiq · June 3, 2021, 1:55pm

Hi @Bryan-Square . Any thoughts. This is an issue for us for the following reasons:

There are many situations where a merchant has multiple locations but they may not want to purchase/authorize/install an application in all locations. For example, some locations may be owned by individual franchise owners who may not want some application.
We need to know the location id. Calling the api to list all locations and then have the user choose their location out of that list seems more error prone. Knowing some of these owners, it is conceivable that they will click on the incorrect location in a hurry

Look forward to hearing your response/thoughts.

Bryan-Square · June 3, 2021, 3:59pm

Hi @wsadiq,

Unfortunately an access token that is scoped to a single location isn’t available with Square OAuth. You do bring up a valid concern however with Square’s account structure a merchant account that has multiple locations is owned by a single merchant. It isn’t structured to be a parent account with individually owned child accounts that have their own set of authorized applications that they use.