# How to make payment to merchant with card on file?

**URL:** <https://developer.squareup.com/forums/t/how-to-make-payment-to-merchant-with-card-on-file/2098>\
**Category:** Questions\
**Created:** [March 16, 2021, 10:05pm UTC](https://developer.squareup.com/forums/t/how-to-make-payment-to-merchant-with-card-on-file/2098 "2021-03-16T22:05:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![craig](https://avatars.discourse-cdn.com/v4/letter/c/ed8c4c/32.png) [@craig](https://developer.squareup.com/forums/u/craig)\
**Post date:** [March 16, 2021, 10:05pm UTC](https://developer.squareup.com/forums/t/how-to-make-payment-to-merchant-with-card-on-file/2098/1 "2021-03-16T22:05:57Z")

</div>

I have an app which stores users cards just prior to placing the first order on the app… this COF is then used for subsequent purchases from various other merchants. Can someone give me a pointer as to where I can find docs which show how to make this payment to the merchant? I assume the locationId (on the CreatePayment) is the identifier for the merchant and the oAuth AccessToken setting somewhere on the client. I am doing this in C#.

I have tried the following when creating the client  
1.  
NOTE: merchantAccessToken is set as a bearer token in the header…  
new Square.SquareClient.Builder()  
.AddAdditionalHeader(“Authorization”,$“Bearer {merchantAccessToken}”)  
.AccessToken(“squareAccessToken”)  
.SquareVersion(“squareVersion”)  
.Environment(“squareEnvironment”)  
.Build();

I have also tried

1. 

NOTE: merchantAccessToken is set as the AccessToken  
new Square.SquareClient.Builder()  
.AccessToken(“merchantAccessToken”)  
.SquareVersion(“squareVersion”)  
.Environment(“squareEnvironment”)  
.Build();

The first method, I get this error message:  
Category: “INVALID\_REQUEST\_ERROR”  
Code: “BAD\_REQUEST”  
Detail: “Not authorized to take payments with location\_id=xxxxxxxxxxx”  
Field: null

The second method, I get the message:  
Category: “AUTHENTICATION\_ERROR”  
Code: “FORBIDDEN”  
Detail: “Unauthorized to use this card”  
Field: “sounce\_id”

Can someone nudge me in the right direction please?

---

<div class="post-metadata">

**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\
**Post date:** [March 17, 2021, 7:17pm UTC](https://developer.squareup.com/forums/t/how-to-make-payment-to-merchant-with-card-on-file/2098/2 "2021-03-17T19:17:22Z")

</div>

The second way would be the correct way (you do not use your own personal access token when making calls on behalf of merchants). With that said, is the `location_id` you’re setting part of the merchant’s account? To be clear, the location and customer\_id, and the `card_id` all need to be a part of the merchant’s account, as they’re scoped per-merchant, not per-application.

Feel free to share your Square app id and the `location_id` that you’re trying to do this with, if the above doesn’t help, and I can take a look at the logs.