Production Web Payments SDK returns 401 Unauthorized on /payments/hydrate despite valid Production Application ID and Location ID

Hi Square Developer Team,

I am integrating the Square Web Payments SDK into a custom-built restaurant ordering website and I am stuck on a production-only issue.

The Web Payments SDK loads successfully and Square.payments() initializes successfully, but payments.card() fails every time.

Environment:

  • Production environment
  • Custom-built website
  • Hosted on Cloudflare Workers
  • Web Payments SDK v1.84.2
  • Currency: AUD

Production Application ID:
sq0idp-QqrTM9kzHDLYYz8lPcleLg

Production Location ID:
LT5EKCPN0NXF5

Website origin:
https://cardamom-cloudflare.contactcardamomrestaurant.workers.dev

The important part is that the SDK successfully reaches:

Square.payments()
→ payments.card()
→ GET https://pci-connect.squareup.com/payments/hydrate

The hydrate request consistently returns:

HTTP 401 Unauthorized

Response:

{
“errors”: [
{
“category”: “AUTHENTICATION_ERROR”,
“code”: “UNAUTHORIZED”,
“detail”: “This request could not be authorized.”
}
]
}

Browser console:

[Square Forensic] BEFORE Square.payments()
[Square Forensic] AFTER Square.payments() {hasPayments: true}
[Square Forensic] BEFORE payments.card()

Then:

GET https://pci-connect.squareup.com/payments/hydrate?… 401 (Unauthorized)

[Square Forensic] FAILED AT payments.card()

The production Application ID and Location ID have been verified directly against the Square Developer Console multiple times.

The Production environment is selected.

The production Square.js SDK is being used.

The page is served over HTTPS and is a secure context.

Square.payments() itself succeeds; the failure occurs specifically when initializing payments.card().

I have also reviewed the recent Square Developer Forum discussion about Web Payments SDK returning 401 on payments/hydrate in production, but the usual Application ID / Location ID configuration checks have already been performed repeatedly.

At this point, could a Square Developer please investigate whether there is an account/application/location-side authorization or eligibility issue that would cause the PCI Connect /payments/hydrate endpoint to reject this production application?

I am specifically looking for help identifying why the PCI Connect hydrate request is returning AUTHENTICATION_ERROR / UNAUTHORIZED even though the production Application ID and Location ID are valid and payments initialization reaches the card method successfully.

I can provide screenshots of the Network request, response, request URL, console output, and Developer Console configuration if required.

Thank you.

Please double check your app ID as it appears to have a typo. App IDs should be copied directly from your dev dashboard. We have seen an uptick of users sending a screenshot of their app IDs to AI tools and these tools often cannot distinguish the number “1”, lowercase “l” and uppercase "I"s.