v0.8.0

Square Terminal for WooCommerce 0.8.0

The plugin now supports the Square Reader: checkouts can hand off to the Square Point of Sale app on a phone or tablet, and the settings page walks merchants through the whole setup.

Added

Square Point of Sale app handoff

Merchants with a Square Reader (contactless + chip) can now take WooCommerce order payments through the Square POS app. The order-pay page, opened on the phone or tablet that runs the Square app, shows a single Open Square Point of Sale button. It launches the app through Square's Point of Sale API deep links (Android intent / square-commerce-v1 on iOS); the app collects the card payment on the Reader and returns the browser to the store.

The return trip is treated as untrusted. The public callback route requires the WooCommerce order key, resolves the returned Square Order ID through Square's Orders and Payments APIs with the merchant's own credentials, and completes the order only from server-verified COMPLETED card payments. Amount, currency, and location are cross-checked; each Square transaction can pay exactly one order (atomic first-use claim); partial payments put the order on hold and block further handoffs; offline payments are recorded for manual verification.

Constraints inherited from Square's API: card tenders only (cash cannot be verified server-side), production environment only (no sandbox support), and the merchant registers their own free Square application whose Web callback URL points at their site.

Changed

Guided Square device setup

The settings page asks "Which Square device do you use?" with two illustrated cards — Square Terminal or Square Reader — and shows only the rows that device needs. Reader mode presents a five-step checklist: connect Square (the Connect link now carries unsaved chooser state across the OAuth round-trip), choose a location (with its own Check your connection button), register the store on Square's developer site, give Square the store's return address, and pair the Reader in the Square app. Steps only read Done when the plugin can verify them server-side. Environment options are labelled Live and Test mode (sandbox), and a live-updating banner explains that the Reader requires Live.

Fixed

Malformed application IDs fail closed

An application ID that does not match Square's production format (sq0idp- plus 22 URL-safe characters — including truncated pastes and trailing whitespace) now disables the handoff button with a clear settings message and is excluded from the payment page data, instead of launching the Square app into an unexplained error.

Upgrade notes

• Existing installs are unaffected by default: the collection method defaults to Square Terminal and all Terminal behaviour is unchanged.
• The Square Reader handoff requires the production environment, a configured location, and a Square application ID registered with the site's callback URL — the settings checklist covers each step.
• Requires PHP 8.1+, WordPress 6.5+, and WooCommerce 8.0+.

Verification status

• Observed: composer lint clean, composer test 279 tests / 960 assertions, composer test:js 34/34 across the three merged PRs (#22, #23, #24); review findings from Greptile, Codex, and CodeRabbit were fixed with regression tests (transaction replay race, fail-open location check, retryable partial payments, stale settings state, application-ID validation).
• Observed: deep-link formats checked verbatim against Square's Point of Sale API mobile web documentation and official examples, including the currency_code key and intent extra prefixes.
• Not verified on a live device: Square provides no sandbox for the Point of Sale API, so the end-to-end handoff (Square app → Reader → callback) has not been exercised against a real Square account. Recommended first-run check: one small live transaction, then confirm the order completes and the note records the verified transaction ID.