# Not authorized to access orders with location\_id while creating a order checkout

**URL:** <https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260>\
**Category:** Questions\
**Tags:** orders-api\
**Created:** [June 20, 2022, 9:58am UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260 "2022-06-20T09:58:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![web.anil](https://avatars.discourse-cdn.com/v4/letter/w/c5a1d2/32.png) [@web.anil](https://developer.squareup.com/forums/u/web.anil)\
**Post date:** [June 20, 2022, 9:58am UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260/1 "2022-06-20T09:58:43Z")

</div>

Hello Folks,

I am trying to create a payment and transfer the amount to a connected merchant account and I’m stuck with the error as below,

“errors”:  
[{“category”:“AUTHENTICATION\_ERROR”,  
“code”:“FORBIDDEN”,  
“detail”:“Not authorized to access orders with location\_id=MLNFQ7QGFRX4B”}]

I have two different account where one I’m using as inter mediator to transfer amount to merchant account directly from end users

and I’m not able to achieve the requirement do help me out with the same.

Here’s my code,

```
	$client = new SquareClient([
		'accessToken' => env('SQUARE_ACCESS_TOKEN'),
		'environment' => Environment::SANDBOX,
	]);

    $amount_money = new \Square\Models\Money();
	$amount_money->setAmount(10000);
	$amount_money->setCurrency('USD');

	$app_fee_money = new \Square\Models\Money();
	$app_fee_money->setAmount(1500);
	$app_fee_money->setCurrency('USD');

	$body = new \Square\Models\CreatePaymentRequest(
		$pay_nonce,
		$sales_dets->sale_id,
		$amount_money
	);
	$body->setAppFeeMoney($app_fee_money);
	$body->setAutocomplete(true);
	$body->setLocationId($square_dets->square_merchant);
	$body->setReferenceId($sales_dets->student_id);
	$body->setNote('Brief description here');

	$api_response = $client->getPaymentsApi()->createPayment($body);

```

Thanks & regards,  
Anil

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [June 20, 2022, 2:48pm UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260/2 "2022-06-20T14:48:30Z")

</div>

👋 Hi Anil, are you using an OAuth access token generated from [OAuth](https://developer.squareup.com/docs/oauth-api/overview) for the account you’re trying to take the payment on behalf of? 🙂

---

<div class="post-metadata">

**Author:** ![web.anil](https://avatars.discourse-cdn.com/v4/letter/w/c5a1d2/32.png) [@web.anil](https://developer.squareup.com/forums/u/web.anil)\
**Post date:** [June 21, 2022, 6:21am UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260/3 "2022-06-21T06:21:11Z")

</div>

Hi Bryan,

I tried plenty of ways to resolve my issue nothing worked.

at last, I figured out that I am supposed to use the merchant access\_token stored while connecting the account, and the location id is supposed to be the developer’s account used as a mediator in the applications side.

after changes this is how my code looks,

```
	$client = new SquareClient([
		'accessToken' => $merchant_square_access, //Merchants access token
		'environment' => Environment::SANDBOX,
	]);

    $order = new \Square\Models\Order(env('LOCATION_ID')); //Developer's account location id

	$price_money = new \Square\Models\Money();
	$price_money->setAmount(15000);
	$price_money->setCurrency('USD');

	$quick_pay = new \Square\Models\QuickPay(
		'Testing Quick Pay',
		$price_money,
		env('LOCATION_ID') //Developer's account location id
	);

	$body = new \Square\Models\CreatePaymentLinkRequest();
	$body->setIdempotencyKey('bae2e9c0-479a-4fba-b835-9792e56f2cb0');
	$body->setQuickPay($quick_pay);
	$body->setSource('');

	$api_response = $client->getCheckoutApi()->createPaymentLink($body);

	if ($api_response->isSuccess()) {	
		$result = $api_response->getResult();
	} else {
		$errors = $api_response->getErrors();
	}

```

Thanks for response, do check my code and please let me know If I’m following the correct way

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [June 21, 2022, 4:42pm UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260/4 "2022-06-21T16:42:03Z")

</div>

Glad to hear you figured it out. All looks good! 🙂

---

<div class="post-metadata">

**Author:** ![Pem18](https://avatars.discourse-cdn.com/v4/letter/p/ecd19e/32.png) [@Pem18](https://developer.squareup.com/forums/u/Pem18)\
**Post date:** [September 27, 2024, 3:27am UTC](https://developer.squareup.com/forums/t/not-authorized-to-access-orders-with-location-id-while-creating-a-order-checkout/6260/5 "2024-09-27T03:27:05Z")

</div>

Look like the user placing the order is not authenticated user. Order was possibly placed by an anonymous user hence forbidden.