# Production Web Payments SDK returns 401 Unauthorized on /payments/hydrate despite valid Production Application ID and Location ID

**URL:** <https://developer.squareup.com/forums/t/production-web-payments-sdk-returns-401-unauthorized-on-payments-hydrate-despite-valid-production-application-id-and-location-id/27933>\
**Category:** Questions\
**Tags:** payments-api, web-payments-sdk\
**Created:** [September 22, 2026, 9:54pm UTC](https://developer.squareup.com/forums/t/production-web-payments-sdk-returns-401-unauthorized-on-payments-hydrate-despite-valid-production-application-id-and-location-id/27933 "2026-09-22T21:54:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![AK-Khan](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@AK-Khan](https://developer.squareup.com/forums/u/AK-Khan)\
**Post date:** [September 22, 2026, 9:54pm UTC](https://developer.squareup.com/forums/t/production-web-payments-sdk-returns-401-unauthorized-on-payments-hydrate-despite-valid-production-application-id-and-location-id/27933/1 "2026-09-22T21:54:35Z")

</div>

Hi Square Developer Team,

I am integrating the Square Web Payments SDK into a custom-built restaurant ordering website and I am stuck on a production-only issue.

The Web Payments SDK loads successfully and Square.payments() initializes successfully, but payments.card() fails every time.

Environment:

- Production environment
- Custom-built website
- Hosted on Cloudflare Workers
- Web Payments SDK v1.84.2
- Currency: AUD

Production Application ID:  
sq0idp-QqrTM9kzHDLYYz8lPcleLg

Production Location ID:  
LT5EKCPN0NXF5

Website origin:  
[https://cardamom-cloudflare.contactcardamomrestaurant.workers.dev](https://cardamom-cloudflare.contactcardamomrestaurant.workers.dev)

The important part is that the SDK successfully reaches:

Square.payments()  
→ payments.card()  
→ GET [https://pci-connect.squareup.com/payments/hydrate](https://pci-connect.squareup.com/payments/hydrate)

The hydrate request consistently returns:

HTTP 401 Unauthorized

Response:

{  
“errors”: [  
{  
“category”: “AUTHENTICATION\_ERROR”,  
“code”: “UNAUTHORIZED”,  
“detail”: “This request could not be authorized.”  
}  
]  
}

Browser console:

[Square Forensic] BEFORE Square.payments()  
[Square Forensic] AFTER Square.payments() {hasPayments: true}  
[Square Forensic] BEFORE payments.card()

Then:

GET [https://pci-connect.squareup.com/payments/hydrate?](https://pci-connect.squareup.com/payments/hydrate?)… 401 (Unauthorized)

[Square Forensic] FAILED AT payments.card()

The production Application ID and Location ID have been verified directly against the Square Developer Console multiple times.

The Production environment is selected.

The production Square.js SDK is being used.

The page is served over HTTPS and is a secure context.

Square.payments() itself succeeds; the failure occurs specifically when initializing payments.card().

I have also reviewed the recent Square Developer Forum discussion about Web Payments SDK returning 401 on payments/hydrate in production, but the usual Application ID / Location ID configuration checks have already been performed repeatedly.

At this point, could a Square Developer please investigate whether there is an account/application/location-side authorization or eligibility issue that would cause the PCI Connect /payments/hydrate endpoint to reject this production application?

I am specifically looking for help identifying why the PCI Connect hydrate request is returning AUTHENTICATION\_ERROR / UNAUTHORIZED even though the production Application ID and Location ID are valid and payments initialization reaches the card method successfully.

I can provide screenshots of the Network request, response, request URL, console output, and Developer Console configuration if required.

Thank you.

---

<div class="post-metadata">

**Author:** ![ashley-square](https://avatars.discourse-cdn.com/v4/letter/a/5f9b8f/32.png) [@ashley-square](https://developer.squareup.com/forums/u/ashley-square)\
**Post date:** [September 23, 2026, 6:23pm UTC](https://developer.squareup.com/forums/t/production-web-payments-sdk-returns-401-unauthorized-on-payments-hydrate-despite-valid-production-application-id-and-location-id/27933/4 "2026-09-23T18:23:50Z")

</div>

Please double check your app ID as it appears to have a typo. App IDs should be copied directly from your dev dashboard. We have seen an uptick of users sending a screenshot of their app IDs to AI tools and these tools often cannot distinguish the number “1”, lowercase “l” and uppercase "I"s.