# Sandbox OAuth authorize fails with 400 unless Dashboard is opened first

**URL:** <https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284>\
**Category:** Questions\
**Tags:** sandbox, oauth-api\
**Created:** [August 21, 2026, 12:20pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284 "2026-08-21T12:20:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dev-Internetsoft](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Dev-Internetsoft](https://developer.squareup.com/forums/u/Dev-Internetsoft)\
**Post date:** [August 21, 2026, 12:20pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284/1 "2026-08-21T12:20:24Z")

</div>

Hi,

I’m opening Square’s Sandbox OAuth authorize URL inside an Android app’s embedded WebView (no prior session/cookies):

[https://connect.squareupsandbox.com/oauth2/authorize?client\_id=YOUR\_CLIENT\_ID&scope=MERCHANT\_PROFILE\_READ+DEVICE\_CREDENTIAL\_MANAGEMENT+ORDERS\_READ+ORDERS\_WRITE+PAYMENTS\_READ+PAYMENTS\_WRITE+MERCHANT\_PROFILE\_WRITE&session=false&state=STATE\_UUID&redirect\_uri=YOUR\_REDIRECT\_URI](https://connect.squareupsandbox.com/oauth2/authorize?client_id=YOUR_CLIENT_ID&scope=MERCHANT_PROFILE_READ+DEVICE_CREDENTIAL_MANAGEMENT+ORDERS_READ+ORDERS_WRITE+PAYMENTS_READ+PAYMENTS_WRITE+MERCHANT_PROFILE_WRITE&session=false&state=STATE_UUID&redirect_uri=YOUR_REDIRECT_URI)

When opened cold in the WebView, this fails with a 400 error:

“To start the OAuth flow for a sandbox account, first launch the seller test account from the Developer Console.”

It only works if I first manually open the Sandbox Dashboard and click “Open” on the Default Test Account before loading the above URL in the WebView. Production’s authorize URL doesn’t have this requirement.

Questions:

1. Is this expected behavior for Sandbox?
2. Is there a way to start the OAuth flow in a WebView without manually opening the test account first?

Thanks!

---

<div class="post-metadata">

**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\
**Post date:** [August 21, 2026, 12:47pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284/3 "2026-08-21T12:47:29Z")

</div>

Yes - this is expected behavior. The sandbox authorization page relies on an active user session.

---

<div class="post-metadata">

**Author:** ![Dev-Internetsoft](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Dev-Internetsoft](https://developer.squareup.com/forums/u/Dev-Internetsoft)\
**Post date:** [August 21, 2026, 1:13pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284/4 "2026-08-21T13:13:35Z")

</div>

@jseok , so for sandbox testing we need to go with active session and then only we can manage to start OAuth flow to get access token for sandbox?

---

<div class="post-metadata">

**Author:** ![jseok](https://avatars.discourse-cdn.com/v4/letter/j/f475e1/32.png) [@jseok](https://developer.squareup.com/forums/u/jseok)\
**Post date:** [August 21, 2026, 1:29pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284/5 "2026-08-21T13:29:39Z")

</div>

Yes that is correct.

---

<div class="post-metadata">

**Author:** ![Dev-Internetsoft](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Dev-Internetsoft](https://developer.squareup.com/forums/u/Dev-Internetsoft)\
**Post date:** [August 21, 2026, 1:30pm UTC](https://developer.squareup.com/forums/t/sandbox-oauth-authorize-fails-with-400-unless-dashboard-is-opened-first/27284/6 "2026-08-21T13:30:05Z")

</div>

@jseok , Thanks for confirming