Hi Square Developer Team,
I am integrating the Square Web Payments SDK into a custom-built restaurant ordering website and I am stuck on a production-only issue.
The Web Payments SDK loads successfully and Square.payments() initializes successfully, but payments.card() fails every time.
Environment:
- Production environment
- Custom-built website
- Hosted on Cloudflare Workers
- Web Payments SDK v1.84.2
- Currency: AUD
Production Application ID:
sq0idp-QqrTM9kzHDLYYz8lPcleLg
Production Location ID:
LT5EKCPN0NXF5
Website origin:
https://cardamom-cloudflare.contactcardamomrestaurant.workers.dev
The important part is that the SDK successfully reaches:
Square.payments()
→ payments.card()
→ GET https://pci-connect.squareup.com/payments/hydrate
The hydrate request consistently returns:
HTTP 401 Unauthorized
Response:
{
“errors”: [
{
“category”: “AUTHENTICATION_ERROR”,
“code”: “UNAUTHORIZED”,
“detail”: “This request could not be authorized.”
}
]
}
Browser console:
[Square Forensic] BEFORE Square.payments()
[Square Forensic] AFTER Square.payments() {hasPayments: true}
[Square Forensic] BEFORE payments.card()
Then:
GET https://pci-connect.squareup.com/payments/hydrate?… 401 (Unauthorized)
[Square Forensic] FAILED AT payments.card()
The production Application ID and Location ID have been verified directly against the Square Developer Console multiple times.
The Production environment is selected.
The production Square.js SDK is being used.
The page is served over HTTPS and is a secure context.
Square.payments() itself succeeds; the failure occurs specifically when initializing payments.card().
I have also reviewed the recent Square Developer Forum discussion about Web Payments SDK returning 401 on payments/hydrate in production, but the usual Application ID / Location ID configuration checks have already been performed repeatedly.
At this point, could a Square Developer please investigate whether there is an account/application/location-side authorization or eligibility issue that would cause the PCI Connect /payments/hydrate endpoint to reject this production application?
I am specifically looking for help identifying why the PCI Connect hydrate request is returning AUTHENTICATION_ERROR / UNAUTHORIZED even though the production Application ID and Location ID are valid and payments initialization reaches the card method successfully.
I can provide screenshots of the Network request, response, request URL, console output, and Developer Console configuration if required.
Thank you.