Square handles checkout, paying an invoice from the client portal, saving a card and background renewal charges. It differs from the other gateways in one important way: a Square account is tied to a location, and that location decides which currency you can take and whether card processing is switched on at all. This article covers the setup, the location trap, and 3-D Secure. It is written for operators.
Before you start #
- A Square account with an application created in the Square Developer Dashboard.
- The application’s Application ID and an Access Token, both from the same environment (Sandbox or Production).
- The Location ID of the location you want to take money through.
- Access to Billing → Payment Gateways in RackHelm, which in a default install means a Super Admin account.
Step 1 — Add the gateway #
- Open Billing → Payment Gateways.
- Select Add Gateway and choose Square, or Configure on the Square row.
- Paste the Application ID. This one is public: the browser uses it to load Square’s card form.
- Paste the Access Token. This one is secret and does the charging.
- Paste the Location ID.
- Set Mode to match the environment your credentials came from.
- Tick Enable Gateway and select Save Changes.
Warning: The Application ID and the Access Token must come from the same environment. A sandbox Application ID with a production token authenticates fine and then fails when the card form loads, which looks like a browser fault rather than a configuration one. The connection test catches this and says the Application ID is for the other environment.
Step 2 — Decide who can see it #
Square gateways added from this release on start as Staff only, so you can test on the live site before customers are offered it.
- Find Who may use it in the gateway dialog.
- Leave it on Staff only while testing.
- Switch to Everyone when you are satisfied, and save.
Step 3 — Run Test connection, and do not skip it #
For Square the connection test is not optional housekeeping. It is how RackHelm learns your location’s currency. Until it has run, Square is offered in the store’s base currency only.
- Select Test connection.
- RackHelm checks the token, looks the location up, confirms the location is active and that card processing is enabled on it, and checks the Application ID’s environment.
- On success it stamps the gateway with the location’s currency, the time and the environment verified.
What the failures mean:
| Message | What to do |
|---|---|
Square refused the access token… |
The token is wrong, revoked, or from the other environment. |
Square does not know location "…" |
The Location ID belongs to a different Square account or environment. |
The Square location is not active. |
Activate the location in Square, or point at one that is. |
The Square location cannot process card payments yet (CREDIT_CARD_PROCESSING is not enabled). |
Square has not finished enabling card processing on that location. This is resolved at Square, not in RackHelm. |
The Application ID is missing: the card form cannot load without it. |
The token may be valid, but customers would see an empty card field. |
The Application ID is for the … |
Environment mismatch between the Application ID and the token. |
Square could not be reached. Try again in a minute. |
Network or TLS, not credentials. |
The gateway settings were changed while the test was running, so nothing was recorded. Run the test again. |
Someone saved the gateway mid-test; the result was discarded rather than stamped against credentials it may not describe. |
Note: The test covers the Application ID, the Access Token, the Location ID and the Mode as a set. Change any one and run it again, or the stored currency may describe the old location.
Step 4 — Upgrading an existing Square gateway #
If you configured Square before this release, open it and run Test connection once. Without it the gateway has no recorded location currency and will only be offered in your base currency, even to customers whose account is set to something else.
Currency #
A Square location takes one currency. RackHelm will not offer a customer a card they could never be charged on: if their account currency does not match, Square is simply not shown, and an attempt to save a card in that currency is refused with:
Card payments through Square are not available for your account currency.
To take more than one currency through Square you need a Square location per currency, and a RackHelm gateway per location.
3-D Secure #
When the customer’s bank asks for it, Square runs the 3-D Secure challenge in the browser before the charge is attempted, as UK and EU rules require. Nothing needs switching on — it happens when the bank demands it. A saved card that later needs a challenge cannot be charged unattended; that renewal is held for staff rather than retried.
What Square is used for, and how #
| Flow | What RackHelm does |
|---|---|
| Checkout | Loads Square’s card form with the Application ID, runs the bank’s challenge if asked, then charges through the Access Token against the configured location. |
| Paying an invoice | Pay Now charges the invoice’s stored amount. Void, cancelled and refunded invoices do not offer it. |
| Saving a card | Stores the card against a Square customer for the account. Removing it in RackHelm also removes it at Square. |
| Renewals | Charges the saved card with an idempotency key per attempt, so a retry after a timeout cannot take the money twice. |
Note: RackHelm only retires a saved card when Square says that specific card is gone. A location problem or another configuration fault no longer causes a customer’s working card to be deleted.
Troubleshooting #
| Symptom | Cause |
|---|---|
| Square missing at checkout for customers only | Who may use it is still Staff only. |
| Square missing for one customer but not another | Their account currency does not match the location’s currency. |
| Square offered in the wrong currency | Test connection has never run, so no location currency is recorded. |
| The card field never appears | Missing or wrong-environment Application ID. |