# Location for app (console claims not authorized, but it definitely is)? **URL:** \ **Category:** Questions\ **Tags:** locations-api, oauth-api, sandbox, payments-api\ **Created:** [June 11, 2025, 12:41am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730 "2025-06-11T00:41:03Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 12:41am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/1 "2025-06-11T00:41:04Z")
I have created an app and an (additional) sandbox test account. I have gone through the OAuth authorize code flow (_non_-PKCE method), requested a refresh token and an access token successfully. I have even used that refresh token and access token to refresh the access token. BUT under the app dev console :: “Locations”, the console reports: “This application hasn’t been authorized and given permissions to access \<_the test account_\>. To create or renew an access token, visit the [OAuth](https://developer.squareup.com/console/apps/sq0idp-b7ZTv5mgE1Tkr6O6RguRBw/oauth) page.” Clearly the app is authorized, since I was given access and refresh tokens that can at least refresh the access token. What am I missing? How do I get the location ID? BTW: I’m ultimately trying to use the “payment-links” API, which apparently requires the location ID. Works with the personal access token and location ID, but that is a security nightmare I’d rather not leave open. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 11, 2025, 5:43pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/2 "2025-06-11T17:43:06Z")
What’s the authorization link your using to get the access token. 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 6:07pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/3 "2025-06-11T18:07:40Z")
For the initial Oath: [https://connect.squareupsandbox.com/oauth2/authorize](https://connect.squareupsandbox.com/oauth2/authorize) For the refresh of tokens: [https://connect.squareupsandbox.com/oauth2/token](https://connect.squareupsandbox.com/oauth2/token) ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 6:15pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/4 "2025-06-11T18:15:41Z")
The dev console for the app shows conflicting information: Under OAuth:: Test account authorizations, the test account is listed, but the Access Token field is empty (reminder: I am able to receive access tokens, I promise.) Authorization Details even shows the correct permissions that were requested. So the authorization definitely took place and is known, at least on some level, to Square servers. Something feels broken. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 11, 2025, 6:26pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/5 "2025-06-11T18:26:24Z")
What permissions are you passing in when you authorize? 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 6:30pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/6 "2025-06-11T18:30:08Z")
ORDERS\_READ, ORDERS\_WRITE, PAYMENTS\_READ, PAYMENTS\_WRITE The dev console Test Authorizations for the test account correctly reports these (and only these) permissions. Also, a somewhat reassuring message, “This authorization was created via the API. You can still renew or revoke this authorization programatically.” So that seems right, to me anyway. Just missing the access token info and location ID ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 11, 2025, 7:13pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/7 "2025-06-11T19:13:32Z")
You will also need: `MERCHANT_PROFILE_READ` and `MERCHANT_PROFILE_WRITE ` if your going to also create locations. 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 7:48pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/8 "2025-06-11T19:48:34Z")
But I don’t want to create new locations. I just need the default location ID associated with the sandbox test account for the app. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 11, 2025, 8:06pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/9 "2025-06-11T20:06:55Z")
Okay then: `MERCHANT_PROFILE_READ ` 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 11:04pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/10 "2025-06-11T23:04:43Z")
Continues to fail in the same manner: I’ve added MERCHANT\_PROFILE\_READ to the OAuth authorization request. I’ve verified under Authorization details that the MERCHANT\_PROFILE\_READ is checked. Locations for the test account that has granted the app Oauth authorization still does not show locations in **square developer console**. It continues to show: “This application hasn’t been authorized and given permissions to access \<_test account_\>. To create or renew an access token, visit the [OAuth](https://developer.squareup.com/console/apps/sq0idp-b7ZTv5mgE1Tkr6O6RguRBw/oauth) page.” This seems like very fundamental functionality. I seem to have followed the Square documentation to the letter. Please advise what else to try. Note: the “Access token” and “Expires” fields under “Test account authorizations” also do not show anything for the test account (although the test account is listed). This does not feel like an OAuth permissions issue. Note: [https://developer.squareup.com/docs/devtools/sandbox/testing](https://developer.squareup.com/docs/devtools/sandbox/testing) describes the per-app sandbox location ID, and how the developer console should display it (and mentions nothing about added permissions for OAuth) ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 11, 2025, 11:45pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/11 "2025-06-11T23:45:24Z")
I was finally able to get the default sandbox location ID by CURLing the locations API manually. It seems to be working, but who knows what other surprises are lurking around the corners. Your developer console, therefore, is seriously broken. - It does not show location IDs properly - It does not show access token information properly. I seriously regret the time I’ve wasted testing and debugging your software. Since I do not need to retrieve the location ID programmatically (or wouldn’t if your web software worked as advertised.) I now have extraneous permissions set. This is really disappointing. I only hope the production workflow functions more reasonably and without added security issues. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 12, 2025, 1:18am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/12 "2025-06-12T01:18:47Z")
Where in the Developer Console did it not correctly show the `location_id` and access token? Was this with one of the sandbox test accounts? 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 12, 2025, 2:00am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/13 "2025-06-12T02:00:35Z")
I’ve exhaustively described my process in this thread, including citations from square documentation. Again, see [https://developer.squareup.com/docs/devtools/sandbox/testing#locations-api](https://developer.squareup.com/docs/devtools/sandbox/testing#locations-api) And, as I said above, “the “Access token” and “Expires” fields under “Test account authorizations”” Which can be found from the developer console::Applications::\<_the app_\>::OAuth ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 12, 2025, 3:31pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/14 "2025-06-12T15:31:31Z")
Those test accounts are designed to represent and entirely different Square account for OAuth testing. That is why the location is not made available in the UI because with OAuth applications have to call the Locations API to get the full list of locations for the account. If your building a custom application that no other sellers are going to use we recommend using the Default Test Account. Those credentials are the ones in the UI of the application. 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 12, 2025, 4:25pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/15 "2025-06-12T16:25:16Z")
> [@Bryan-Square](#): > > Those test accounts are designed to represent and entirely different Square account for OAuth testing. That is why the location is not made available in the UI because with OAuth applications have to call the Locations API to get the full list of locations for the account. This exactly contradicts what the square documentation says: “The Sandbox location ID is listed on the **Locations** page for each application in the Developer Console. You can also retrieve the location ID programmatically by calling ListLocations with a Sandbox access token.” From: [https://developer.squareup.com/docs/devtools/sandbox/testing#locations-api](https://developer.squareup.com/docs/devtools/sandbox/testing#locations-api) There’s no mention that this only applies to the default sandbox. Furthermore, the dev console UI has a dropdown to select all of the sandbox accounts specifically for location. If the dev console is not meant to show non-default sandbox account locations, why does the dev console UI have a dropdown option to select non-default sandbox accounts? And why does it erroneously display an error message that the App has not been authorized for the sandbox account? Absolutely nothing in the documentation or the dev console UI is indicative of what you’re saying. ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 12, 2025, 4:42pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/16 "2025-06-12T16:42:12Z")
By the way, when using the default sandbox account to obtain refresh and access tokens with OAuth: Upon successfully authorizing and receiving an access token, the dev console::OAuth::“Test account authorizations” section does NOT show the newly acquired access token and expiration in the table. It just displays an additional, identical row in the table for the default sandbox test account with the same access token (the default “personal” token) and no expiration. Which is NOT what is returned in the OAuth flow (thankfully). What is the point of displaying multiple, identical rows while omitting the useful information of the OAuth acquired access tokens? This must be yet another bug. Or at least I can’t imagine that is the intended behavior. ---
**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\ **Post date:** [June 12, 2025, 5:09pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/17 "2025-06-12T17:09:16Z")
The information about the test accounts is in the [OAuth section](https://developer.squareup.com/docs/oauth-api/walkthrough#3-set-up-a-seller-test-account-and-simulate-the-seller-authorization). With the Default test account there is no need to get a refresh token. You can use the access token from the credentials. That token won’t expire. You don’t have to OAuth with that token. 🙂 ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 12, 2025, 6:08pm UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/18 "2025-06-12T18:08:52Z")
> [@Bryan-Square](#): > > The information about the test accounts is in the OAuth section. Nothing here addresses any of the issues, erroneous behavior, bugs, or contradicting information that has been discussed in this topic thread. > [@Bryan-Square](#): > > With the Default test account there is no need to get a refresh token. You can use the access token from the credentials. That token won’t expire. You don’t have to OAuth with that token. As I mentioned in my very first post of this topic thread, the problem with using the default access token, and not using OAuth, is that the default access token is fully privileged with all permissions. With all due respect, this thread is starting to feel like a conversation with a poorly trained LLM. ---
**Author:** ![UtterlyVoice](https://avatars.discourse-cdn.com/v4/letter/u/439d5e/32.png) [@UtterlyVoice](https://developer.squareup.com/forums/u/UtterlyVoice)\ **Post date:** [June 16, 2025, 12:07am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/19 "2025-06-16T00:07:29Z")
I am having the exact same problem. I created the “Test Seller Account” as [recommended in the documentation](https://developer.squareup.com/docs/oauth-api/walkthrough#3-set-up-a-seller-test-account-and-simulate-the-seller-authorization), so I could test my OAuth code in the sandbox. It is recommended in this thread to use the personal sandbox access token, but that approach does not test my OAuth code. The developer console does not let me access the location ID for this test account, so I can’t make any requests. I have had a very frustrating day trying to figure this out. ---
**Author:** ![LGuapo](https://avatars.discourse-cdn.com/v4/letter/l/4491bb/32.png) [@LGuapo](https://developer.squareup.com/forums/u/LGuapo)\ **Post date:** [June 16, 2025, 1:25am UTC](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730/20 "2025-06-16T01:25:34Z")
What I eventually figured out is that you have two choices: 1. You actually can use the default sandbox test account for OAuth. (Just ignore the default access token for the default sandbox test account.) That will let you use the location ID shown in the dev console for the default sandbox test account. BUT since you can’t just delete the default sandbox test account, it’s not great for development IMHO. You can revoke access tokens, sure, but who knows what state is hanging around on the square side (the dev console shows all kinds of weirdnesses that are apparently inexplicable, as I’ve described in this thread.) 2. You can use the additional sandbox test accounts and get the location IDs using the API: [https://developer.squareup.com/reference/square/locations-api/list-locations](https://developer.squareup.com/reference/square/locations-api/list-locations) You can try to use the square API explorer to do this, but honestly, I recommend just curling it yourself manually on CLI or in a script. This is nice since you can delete these sandbox test accounts with (at least more) certainty that things are being cleaned up. Nothing in the square documentation or the behavior of the square dev console (or basic common sense) would make one think either of these options is the correct path, but it does seem to be the only two options as far as I’ve been able to tell. Hope this helps. [Next page](https://developer.squareup.com/forums/t/location-for-app-console-claims-not-authorized-but-it-definitely-is/22730.md?page=2)