Setting Up Square Payments

VendorHearth Pro can connect directly to Square for vendor payments.

To complete the connection, you will need information from your Square Developer account and will need to create a webhook that allows Square to send payment updates back to VendorHearth.

This setup should be completed by an administrator with access to your organization’s Square account.

Before You Begin #

You will need:

• An active Square account
• Access to the Square Developer Console
• Administrator access to your WordPress website
• VendorHearth Pro installed and activated
• HTTPS enabled on your website

You will be working between your Square Developer Console and VendorHearth Pro.

Step 1: Open the Square Developer Console #

Sign in to the Square Developer Console using the Square account that will receive your vendor payments.

If you already have a Square application you intend to use with VendorHearth, open that application.

Otherwise, create a new application for your VendorHearth integration.

Using a recognizable name such as:

VendorHearth

or:

VendorHearth – Your Organization Name

can make the application easier to identify later.

Step 2: Decide Between Sandbox and Production #

Square provides two environments:

Sandbox #

Use Sandbox while testing your integration.

Sandbox transactions are test transactions and do not charge real payment cards.

Production #

Use Production when you are ready to accept real vendor payments.

Sandbox and Production use different credentials.

Do not mix Sandbox credentials with Production credentials.

Step 3: Open VendorHearth Payment Settings #

In another browser tab, open your WordPress Dashboard.

Navigate to the VendorHearth payment configuration.

Select Square as your payment gateway if it has not already been selected.

You will see fields for the Square information VendorHearth needs.

Keep this page open while you retrieve your information from Square.

Step 4: Select the Environment #

In VendorHearth, select the Square environment you intend to use.

Choose:

Sandbox for testing

or:

Production for live payments

The credentials entered in the following steps must match the environment selected here.

Step 5: Copy the Square Application ID #

Return to your Square Developer application.

Open Credentials and make sure you are viewing the correct environment.

Locate the Application ID.

Copy the Application ID and paste it into the corresponding Application ID field in VendorHearth.

Be careful not to accidentally copy a Sandbox Application ID while configuring VendorHearth for Production.

Step 6: Copy the Location ID #

In the Square Developer Console, open Locations.

Locate the Square location that should receive your VendorHearth payments.

Copy its Location ID.

Return to VendorHearth and paste it into the Location ID field.

If your Square account contains multiple locations, make sure you select the correct one.

Step 7: Copy the Access Token #

Return to Credentials in your Square Developer application.

Make sure you are still viewing the correct environment.

Locate the appropriate Access Token.

You may need to select Show before Square displays the token.

Copy the token and paste it into the Access Token field in VendorHearth.

Important #

Your Square Access Token is sensitive.

Treat it like a password.

Do not:

• Publish it in documentation
• Send it through public messages
• Include it in screenshots
• Post it in support forums
• Share it with vendors

Anyone with access to your production token may have significant access to your Square account through the Square APIs.

Step 8: Save Your Square Settings #

At this point, VendorHearth should have:

• Environment
• Application ID
• Location ID
• Access Token

Save your payment settings.

You still need to configure the webhook before the Square setup is complete.

Step 9: Find the VendorHearth Webhook URL #

VendorHearth provides the webhook URL that Square needs to send payment updates back to your website.

Locate the Webhook URL displayed in the VendorHearth Square settings.

Copy this URL exactly as VendorHearth provides it.

Do not manually modify the webhook URL.

Your website must be using HTTPS and the webhook URL must be publicly reachable by Square.

Step 10: Open Square Webhooks #

Return to your Square Developer application.

Navigate to:

Webhooks → Subscriptions

Make sure you are working in the same environment you selected in VendorHearth.

If you are configuring Sandbox, create the webhook in Sandbox.

If you are configuring live payments, create it in Production.

Step 11: Add a Webhook Subscription #

Select Add Subscription.

Give the webhook a recognizable name, such as:

VendorHearth Payments

For the notification URL, paste the Webhook URL provided by VendorHearth.

Do not use your website homepage as the webhook URL.

Use the exact VendorHearth webhook URL displayed in the Square settings.

Step 12: Select the Payment Event #

Square will ask which events should be sent to the webhook.

VendorHearth uses:

payment.updated

Select payment.updated as an event for the VendorHearth webhook subscription.

This event allows Square to notify VendorHearth when payment information changes, including when a payment reaches a completed status.

Save the webhook subscription.

Step 13: Copy the Webhook Signature Key #

After creating the webhook subscription, open its details in Square.

Locate the Signature Key.

Select Show if necessary.

Copy the Signature Key.

Return to your VendorHearth Square settings and paste it into the Webhook Signature Key field.

Save your VendorHearth payment settings again.

Why the Signature Key Matters #

The Signature Key allows VendorHearth to verify that webhook notifications actually came from Square.

Without proper webhook verification, anyone could potentially attempt to send information to a public webhook endpoint.

Do not publish or share your Webhook Signature Key.

Step 14: Review the Complete Configuration #

Your VendorHearth Square settings should now contain:

Environment
Sandbox or Production

Application ID
From Square → Credentials

Location ID
From Square → Locations

Access Token
From Square → Credentials

Webhook URL
Provided by VendorHearth

Webhook Signature Key
From the Square webhook subscription

Your Square webhook should also be subscribed to:

payment.updated

Step 15: Test Before Accepting Real Payments #

Do not assume the integration is working simply because all fields have been filled in.

Test the connection before directing vendors to make payments.

When initially configuring VendorHearth, using Square’s Sandbox environment is the safest way to verify the integration without processing a real payment.

After testing successfully, switch VendorHearth to Production and enter the corresponding Production credentials.

Remember that Sandbox credentials cannot be used for Production payments.

Moving From Sandbox to Production #

When you are ready to accept real payments:

1. Change VendorHearth to Production.
2. Retrieve your Production Application ID.
3. Retrieve the correct Production Location ID.
4. Retrieve your Production Access Token.
5. Create or verify the Production webhook subscription.
6. Use VendorHearth’s webhook URL.
7. Subscribe the webhook to payment.updated.
8. Copy the Production webhook Signature Key into VendorHearth.
9. Save your settings.
10. Test the live configuration carefully before opening payments to vendors.

Do not simply change the environment from Sandbox to Production while leaving Sandbox credentials in place.

If You Change the Webhook #

If you delete and recreate the Square webhook subscription, Square may provide a different Signature Key.

Update the Signature Key stored in VendorHearth whenever the corresponding Square webhook configuration changes.

An incorrect Signature Key can prevent VendorHearth from validating payment notifications.

Security Reminder #

Never include your actual Square credentials when requesting general support.

If you need to provide a screenshot of your Square or VendorHearth settings, hide:

• Access Tokens
• Signature Keys
• Other private credentials

Your Application ID and Location ID are identifiers, but sensitive authentication credentials such as your Access Token should always remain private.

Square Setup Checklist #

Before considering Square setup complete, confirm:

• Correct Square application selected
• Correct environment selected
• Application ID entered
• Location ID entered
• Access Token entered
• VendorHearth settings saved
• VendorHearth Webhook URL copied into Square
• Square webhook subscription created
• payment.updated selected
• Webhook Signature Key entered in VendorHearth
• Settings saved again
• Payment integration tested

Once these steps are complete, VendorHearth and Square are ready to communicate during the vendor payment workflow.

Next Step #

Continue to Understanding the Square Webhook to learn what the webhook does, why payment.updated is required, and how Square payment updates reach VendorHearth.