Sandbox OAuth authorize fails with 400 unless Dashboard is opened first

Questions
,
1

Hi,

I’m opening Square’s Sandbox OAuth authorize URL inside an Android app’s embedded WebView (no prior session/cookies):

https://connect.squareupsandbox.com/oauth2/authorize?client_id=YOUR_CLIENT_ID&scope=MERCHANT_PROFILE_READ+DEVICE_CREDENTIAL_MANAGEMENT+ORDERS_READ+ORDERS_WRITE+PAYMENTS_READ+PAYMENTS_WRITE+MERCHANT_PROFILE_WRITE&session=false&state=STATE_UUID&redirect_uri=YOUR_REDIRECT_URI

When opened cold in the WebView, this fails with a 400 error:

“To start the OAuth flow for a sandbox account, first launch the seller test account from the Developer Console.”

It only works if I first manually open the Sandbox Dashboard and click “Open” on the Default Test Account before loading the above URL in the WebView. Production’s authorize URL doesn’t have this requirement.

Questions:

  1. Is this expected behavior for Sandbox?
  2. Is there a way to start the OAuth flow in a WebView without manually opening the test account first?

Thanks!

3

Yes - this is expected behavior. The sandbox authorization page relies on an active user session.

4

@jseok , so for sandbox testing we need to go with active session and then only we can manage to start OAuth flow to get access token for sandbox?

5

Yes that is correct.

6

@jseok , Thanks for confirming