# Square /oauth2/authorize 400

**URL:** <https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873>\
**Category:** Questions\
**Tags:** oauth-api\
**Created:** [December 23, 2025, 9:21am UTC](https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873 "2025-12-23T09:21:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Seamus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Seamus](https://developer.squareup.com/forums/u/Seamus)\
**Post date:** [December 23, 2025, 9:21am UTC](https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873/1 "2025-12-23T09:21:01Z")

</div>

Hey!

I’m building an OAuth authorization URL, so that users of my app (Luhme) can click on it and connect their Luhme account to their Square one. The URL that gets built is [https://connect.squareupsandbox.com/oauth2/authorize?client\_id=xxx&scope=ITEMS\_READ+PAYMENTS\_WRITE+MERCHANT\_PROFILE\_READ&state=xxx](https://connect.squareupsandbox.com/oauth2/authorize?client_id=xxx&scope=ITEMS_READ+PAYMENTS_WRITE+MERCHANT_PROFILE_READ&state=xxx).

However, when users get redirected to this link (by setting window.location.href in the client side JS, the URL is built by the API server), the page stays blank and a 400 error appears in the console. The response text is simply “Bad Request”. I don’t see any logs in the Square API dashboard either.

If you’d like to reproduce this, you can head over to demonstration.luhme.app/vendor and use the username “no POS vendor” and the password “test”.

If anyone has experienced this before, or has any ideas about how to solve this / how I could debug it, that would be much much appreciated!

Seamus

---

<div class="post-metadata">

**Author:** ![Square-Dev-AI](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/square-dev-ai/32/2513_2.png) [@Square-Dev-AI](https://developer.squareup.com/forums/u/Square-Dev-AI)\
**Post date:** [December 23, 2025, 9:21am UTC](https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873/2 "2025-12-23T09:21:18Z")

</div>

👋 I’m Square Dev AI, here to help answer your question!  
Based on the information you’ve provided, the following documentation will help answer your question:

> **[Test Authorization with Web Server](https://developer.squareup.com/docs/oauth-api/build-with-oauth)**
>
> Learn how to build a Square OAuth API flow to authorize your application to access a Square account.

> **[Test Authorization with Web Server](https://developer.squareup.com/docs/oauth-api/walkthrough)**
>
> Learn how to build a Square OAuth API flow to authorize your application to access a Square account.

> **Additional Documentation**
>
> [Square Sandbox](https://developer.squareup.com/docs/devtools/sandbox/overview)  
> [OAuth API](https://developer.squareup.com/docs/oauth-api/how-it-works)  
> [OAuth API](https://developer.squareup.com/docs/oauth-api/overview)

If this documentation helped you find a solution, please check the box indicating that this reply solves the problem.  
Otherwise one of our Developer Advocates will provide additional assistance shortly.

---

<div class="post-metadata">

**Author:** ![Seamus](https://avatars.discourse-cdn.com/v4/letter/s/2bfe46/32.png) [@Seamus](https://developer.squareup.com/forums/u/Seamus)\
**Post date:** [December 23, 2025, 9:25am UTC](https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873/3 "2025-12-23T09:25:07Z")

</div>

Nevermind, silly me, I needed to open the seller dash 🤦

---

<div class="post-metadata">

**Author:** ![Bryan-Square](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/bryan-square/32/38_2.png) [@Bryan-Square](https://developer.squareup.com/forums/u/Bryan-Square)\
**Post date:** [December 29, 2025, 3:46pm UTC](https://developer.squareup.com/forums/t/square-oauth2-authorize-400/24873/4 "2025-12-29T15:46:23Z")

</div>

Glad to hear that you figured it out. 🙂