--- title: Setting Up Square Payments description: VendorHearth Pro can connect directly to Square for vendor payments. To complete the connection, you will need information from your Square Developer account and will need to create a webhook that allows Square to send payment updates back to VendorHearth.… url: "https://vendorhearth.com/docs/setting-up-square-payments/" updated: "2026-09-23" category: Payments — Square, payment statuses, deadlines, reconciliation, manual payments --- # Setting Up Square Payments VendorHearth Pro can connect directly to Square for vendor payments. To complete the connection, you will need information from your Square Developer account and will need to create a webhook that allows Square to send payment updates back to VendorHearth. This setup should be completed by an administrator with access to your organization's Square account. ## Before You Begin You will need: - An active Square account - Access to the Square Developer Console - Administrator access to your WordPress website - VendorHearth Pro installed and activated - HTTPS enabled on your website You will be working between your **Square Developer Console** and **VendorHearth Pro**. ## Step 1: Open the Square Developer Console Sign in to the Square Developer Console using the Square account that will receive your vendor payments. If you already have a Square application you intend to use with VendorHearth, open that application. Otherwise, create a new application for your VendorHearth integration. Using a recognizable name such as: **VendorHearth** or: **VendorHearth – Your Organization Name** can make the application easier to identify later. ## Step 2: Decide Between Sandbox and Production Square provides two environments: ### Sandbox Use Sandbox while testing your integration. Sandbox transactions are test transactions and do not charge real payment cards. ### Production Use Production when you are ready to accept real vendor payments. Sandbox and Production use different credentials. Do not mix Sandbox credentials with Production credentials. ## Step 3: Open VendorHearth Payment Settings In another browser tab, open your WordPress Dashboard. Navigate to the VendorHearth payment configuration. Select **Square** as your payment gateway if it has not already been selected. You will see fields for the Square information VendorHearth needs. Keep this page open while you retrieve your information from Square. ## Step 4: Select the Environment In VendorHearth, select the Square environment you intend to use. Choose: **Sandbox** for testing or: **Production** for live payments The credentials entered in the following steps must match the environment selected here. ## Step 5: Copy the Square Application ID Return to your Square Developer application. Open **Credentials** and make sure you are viewing the correct environment. Locate the **Application ID**. Copy the Application ID and paste it into the corresponding **Application ID** field in VendorHearth. Be careful not to accidentally copy a Sandbox Application ID while configuring VendorHearth for Production. ## Step 6: Copy the Location ID In the Square Developer Console, open **Locations**. Locate the Square location that should receive your VendorHearth payments. Copy its **Location ID**. Return to VendorHearth and paste it into the **Location ID** field. If your Square account contains multiple locations, make sure you select the correct one. ## Step 7: Copy the Access Token Return to **Credentials** in your Square Developer application. Make sure you are still viewing the correct environment. Locate the appropriate **Access Token**. You may need to select **Show** before Square displays the token. Copy the token and paste it into the **Access Token** field in VendorHearth. ### Important Your Square Access Token is sensitive. Treat it like a password. Do not: - Publish it in documentation - Send it through public messages - Include it in screenshots - Post it in support forums - Share it with vendors Anyone with access to your production token may have significant access to your Square account through the Square APIs. ## Step 8: Save Your Square Settings At this point, VendorHearth should have: - Environment - Application ID - Location ID - Access Token Save your payment settings. You still need to configure the webhook before the Square setup is complete. ## Step 9: Find the VendorHearth Webhook URL VendorHearth provides the webhook URL that Square needs to send payment updates back to your website. Locate the **Webhook URL** displayed in the VendorHearth Square settings. Copy this URL exactly as VendorHearth provides it. Do not manually modify the webhook URL. Your website must be using HTTPS and the webhook URL must be publicly reachable by Square. ## Step 10: Open Square Webhooks Return to your Square Developer application. Navigate to: **Webhooks → Subscriptions** Make sure you are working in the same environment you selected in VendorHearth. If you are configuring Sandbox, create the webhook in Sandbox. If you are configuring live payments, create it in Production. ## Step 11: Add a Webhook Subscription Select **Add Subscription**. Give the webhook a recognizable name, such as: **VendorHearth Payments** For the notification URL, paste the **Webhook URL** provided by VendorHearth. Do not use your website homepage as the webhook URL. Use the exact VendorHearth webhook URL displayed in the Square settings. ## Step 12: Select the Payment Event Square will ask which events should be sent to the webhook. VendorHearth uses: `payment.updated` Select **payment.updated** as an event for the VendorHearth webhook subscription. This event allows Square to notify VendorHearth when payment information changes, including when a payment reaches a completed status. Save the webhook subscription. ## Step 13: Copy the Webhook Signature Key After creating the webhook subscription, open its details in Square. Locate the **Signature Key**. Select **Show** if necessary. Copy the Signature Key. Return to your VendorHearth Square settings and paste it into the **Webhook Signature Key** field. Save your VendorHearth payment settings again. ## Why the Signature Key Matters The Signature Key allows VendorHearth to verify that webhook notifications actually came from Square. Without proper webhook verification, anyone could potentially attempt to send information to a public webhook endpoint. Do not publish or share your Webhook Signature Key. ## Step 14: Review the Complete Configuration Your VendorHearth Square settings should now contain: **Environment** Sandbox or Production **Application ID** From Square → Credentials **Location ID** From Square → Locations **Access Token** From Square → Credentials **Webhook URL** Provided by VendorHearth **Webhook Signature Key** From the Square webhook subscription Your Square webhook should also be subscribed to: `payment.updated` ## Step 15: Test Before Accepting Real Payments Do not assume the integration is working simply because all fields have been filled in. Test the connection before directing vendors to make payments. When initially configuring VendorHearth, using Square's Sandbox environment is the safest way to verify the integration without processing a real payment. After testing successfully, switch VendorHearth to Production and enter the corresponding Production credentials. Remember that Sandbox credentials cannot be used for Production payments. ## Moving From Sandbox to Production When you are ready to accept real payments: 1. Change VendorHearth to **Production**. 2. Retrieve your Production Application ID. 3. Retrieve the correct Production Location ID. 4. Retrieve your Production Access Token. 5. Create or verify the Production webhook subscription. 6. Use VendorHearth's webhook URL. 7. Subscribe the webhook to `payment.updated`. 8. Copy the Production webhook Signature Key into VendorHearth. 9. Save your settings. 10. Test the live configuration carefully before opening payments to vendors. Do not simply change the environment from Sandbox to Production while leaving Sandbox credentials in place. ## If You Change the Webhook If you delete and recreate the Square webhook subscription, Square may provide a different Signature Key. Update the Signature Key stored in VendorHearth whenever the corresponding Square webhook configuration changes. An incorrect Signature Key can prevent VendorHearth from validating payment notifications. ## Security Reminder Never include your actual Square credentials when requesting general support. If you need to provide a screenshot of your Square or VendorHearth settings, hide: - Access Tokens - Signature Keys - Other private credentials Your Application ID and Location ID are identifiers, but sensitive authentication credentials such as your Access Token should always remain private. ## Square Setup Checklist Before considering Square setup complete, confirm: - Correct Square application selected - Correct environment selected - Application ID entered - Location ID entered - Access Token entered - VendorHearth settings saved - VendorHearth Webhook URL copied into Square - Square webhook subscription created - `payment.updated` selected - Webhook Signature Key entered in VendorHearth - Settings saved again - Payment integration tested Once these steps are complete, VendorHearth and Square are ready to communicate during the vendor payment workflow. ## Next Step Continue to **Understanding the Square Webhook** to learn what the webhook does, why `payment.updated` is required, and how Square payment updates reach VendorHearth.