v0.5.0

Square Terminal for WooCommerce 0.5.0

Setting the plugin up no longer requires creating your own Square application.

Added

Connect to Square

The gateway settings screen has a Connect to Square button. Authorize the site once and the access token is obtained and kept current automatically — no Square application to create, no access token to copy and paste.

How the credentials are handled. The flow uses PKCE, which removes the need for an application secret. Your site performs the token exchange itself and is the only holder of the resulting tokens.

Square permits a single registered redirect URL per application, so a fixed endpoint on wcpos.com receives the authorization response and forwards it to your site. That endpoint holds no Square application secret and never receives a token: the PKCE code verifier never leaves your server, so the authorization code passing through cannot be exchanged by anyone but you.

The permissions requested are exactly those the plugin uses — merchant profile, payments read and write, and Terminal device management. Square shows them for approval before anything is granted.

A lapsed connection now explains itself

Square's PKCE refresh tokens are single use and expire 90 days after issue. A renewal that cannot be completed clears the stored credentials rather than retrying a token that can no longer work, and the settings screen reports that reconnection is required — instead of quietly reverting to a disconnected state and failing the next payment.

Changed

• Enable is now Enable/Disable, and states that it governs the online store checkout only. WooCommerce POS uses this gateway once it is configured, whether or not it is enabled here; the previous wording implied the POS needed it too. This matches the Stripe and SumUp Terminal plugins.

Upgrade notes

• Nothing changes for existing installs. Manually configured access tokens keep working exactly as before and are used whenever the site is not connected. Connecting is optional.
• An OAuth connection applies only to the environment it was authorized against. A sandbox connection can never authorize production requests.
• Requires PHP 8.1+, WordPress 6.5+, and WooCommerce 8.0+.

Verification status

• Observed: composer lint clean, composer test 218 tests / 743 assertions, composer test:js 26/26.
• Observed: the wcpos.com endpoint is live. It builds a valid Square authorization URL, forwards a callback to the originating site, and refuses both forged state (400) and non-public callback URLs (400). Square accepts the application, permissions and PKCE challenge.
• Observed: a token exchange carrying only the application ID, code and code verifier reaches Square's authorization-code lookup and is refused on the code — never on a missing application secret.
• Not verified: a complete authorization performed by a signed-in Square user. The steps either side of that have been exercised against the live API; the approval itself needs a browser and has not been run.