Hi Yason, I’m getting 0 insights from dev tools and also when putting the site into debug mode.
The error is not a bank decline or a tokenization failure. From a full HAR capture, that error string is RestroPress’s server-side gateway_error, rendered into the admin-ajax.php?payment-mode=square (rpress_load_gateway) response. The gateway sets it server-side at one specific point: when the purchase form is POSTed to the backend with the rpsquare_token field empty.
We confirmed it’s not a front-end tokenize failure by reading the gateway’s own inline script: on card.tokenize() failure it writes “Payment Failed” inline and does not submit. The error we see is the server path, which means the form was submitted — with no token.
The SDK itself initialises cleanly. In the HAR, pci-connect.squareup.com/payments/hydrate returns 200 and we see a MAIN_IFRAME:OK telemetry event. The two pci-connect.../mtx/v2 calls returning 204 are Square’s metrics beacons (request bodies are {"metrics":[…]}), not the tokenize call.
We found and resolved one real blocker that was masking things: Brave Shields was blocking the tokenize POST with net::ERR_BLOCKED_BY_CLIENT. With Shields off that’s gone — but the intermittent failures persist on other browsers, so that was a separate, browser-specific issue, not the root cause.
We also confirmed a session-persistence artifact: once gateway_error is set, RestroPress re-prints it on every gateway reload until the session clears, which made one failure look permanent on desktop. A fresh session cleared it.
Usually we see an error in the Square API logs, though now they are empty: because no CreatePayment with a token ever reaches Square. The RestroPress backend rejects the empty rpsquare_token before calling the Square API, so there’s nothing for Square to log. The empty logs are consistent with the failure, not a contradiction.
The honest question: under what conditions can card.tokenize() return or resolve such that the token field ends up empty at submit time — e.g. tokenize latency, an iframe not fully attached, or the SCA/verifyBuyer step being absent? And does anything in the SDK’s behaviour on iOS WebKit (storage partitioning / cross-site tracking prevention on the payment iframe) change tokenize timing or success?