Square OAuth Scopes

generated: '2026-07-11'
method: derived
source: openapi/square-openapi.yml
schemes:
- name: oauth2
  source: openapi/square-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://connect.squareup.com/oauth2/authorize
    tokenUrl: https://connect.squareup.com/oauth2/token
scopes:
- scope: ADDON_CONFIGURATIONS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants write access for third-party Add-ons to read configurations of their Add-ons, for example, when calling `RetrieveConfiguration` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ADDON_CONFIGURATIONS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access for third-party Add-ons to store configurations of their Add-ons, for example, when calling `CreateConfiguration` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: APPOINTMENTS_ALL_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to all of a seller's booking information, calendar, and business details.
    This permission must be accompanied by the `APPOINTMENTS_READ` permission.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: APPOINTMENTS_ALL_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to all booking details, including double-booking a seller.
    This permission must be accompanied by the `APPOINTMENTS_WRITE` permission.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: APPOINTMENTS_BUSINESS_SETTINGS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to booking business settings. For example, to call the
    ListTeamMemberBookingProfiles endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: APPOINTMENTS_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to booking information. For example, to call the
    RetrieveBooking endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: APPOINTMENTS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to booking information. For example, to call the CreateBooking endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: BANK_ACCOUNTS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to bank account information associated with the targeted
    Square account. For example, to call the Connect v1 ListBankAccounts endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CASH_DRAWER_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to cash drawer shift information. For example, to call the
    ListCashDrawerShifts endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CHANNELS_CREATE
  description: |-
    __HTTP Method__: `POST`

    Grants write access to create channels, for example, when calling the
    `CreateChannel` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CHANNELS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to view channels, for example, when calling the
    `RetrieveChannel` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CHANNELS_UPDATE
  description: |-
    __HTTP Method__: `PUT`

    Grants write access to update channels, for example, when calling the
    `UpdateChannel` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CUSTOMERS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to customer information. For example, to call the
    ListCustomers endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: CUSTOMERS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to customer information. For example, to create and update
    customer profiles.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: DEVICES_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to device information. For example, to
    call the `GetDevice` and `ListDevices` endpoints.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: DEVICE_CREDENTIAL_MANAGEMENT
  description: |-
    __HTTP Method__: `POST`, `GET`

    Grants read/write access to device credentials information. For example, to
    call the CreateDeviceCode endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: DISPUTES_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to dispute information. For example, to call the RetrieveDispute
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: DISPUTES_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to dispute information. For example, to call the SubmitEvidence
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: EMPLOYEES_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to employee profile information. For example, to call the
    Connect v1 Employees API.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: EMPLOYEES_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to employee profile information. For example, to create
    and modify employee profiles.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: GIFTCARDS_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to gift card information. For example, to call the RetrieveGiftCard
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: GIFTCARDS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to gift card information. For example, to call the CreateGiftCard
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: INVENTORY_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to inventory information. For example, to call the
    RetrieveInventoryCount endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: INVENTORY_WRITE
  description: |-
    __HTTP Method__:  `POST`, `PUT`, `DELETE`

    Grants write access to inventory information. For example, to call the
    BatchChangeInventory endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: INVOICES_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to invoice information. For example, to call the ListInvoices endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: INVOICES_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to invoice information. For example, to call the CreateInvoice endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ITEMS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to product catalog information. For example, to obtain objects in a product catalog.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ITEMS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to product catalog information. For example, to modify or
    add to a product catalog.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: LOYALTY_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to loyalty information. For example, to call the
    ListLoyaltyPrograms endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: LOYALTY_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to loyalty information. For example, to call the
    CreateLoyaltyAccount endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: MERCHANT_PROFILE_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to business and location information. For example, to
    obtain a location ID for subsequent activity.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: MERCHANT_PROFILE_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`

    Grants write access to business and location information. For example, to create a new location or
    update the business hours at an existing location.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ONLINE_STORE_SITE_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Read access to ECOM online store site details.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ONLINE_STORE_SNIPPETS_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Read access to ECOM online store snippets on published websites.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ONLINE_STORE_SNIPPETS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Write access to ECOM online store snippets on published websites.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ORDERS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to order information. For example, to call the
    BatchRetrieveOrders endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: ORDERS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to order information. For example, to call the
    CreateCheckout endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENTS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to transaction and refund information. For example, to call
    the RetrieveTransaction endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENTS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to transaction and refunds information. For example, to
    process payments with the Payments or Checkout API.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Allow third party applications to deduct a portion of each transaction amount.
    __Required__ to use multiparty transaction functionality with the Payments
    API.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENTS_WRITE_IN_PERSON
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to payments and refunds information. For example, to
    process in-person payments.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENTS_WRITE_SHARED_ONFILE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Allows the developer to process payments on behalf of a seller using a shared on file payment method.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PAYMENT_METHODS_READ
  sources:
  - openapi/square-openapi.yml
- scope: PAYOUTS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to payouts and payout entries information. For example,
    to call the Connect v2 `ListPayouts` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PERMISSION_SETS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to Permission Sets. For example, to
    call the `ListPermissionSets` and `RetrievePermissionSet` endpoints.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: PERMISSION_SETS_WRITE
  description: |-
    __HTTP Method__: `PUT`

    Grants write access to Permission Sets.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: RESERVATIONS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to reservation information, for example, when calling the
    `RetrieveReservation` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: RESERVATIONS_WRITE
  description: |-
    __HTTP Method__:  `POST`, `PUT`, `DELETE`

    Grants write access to reservation information, for example, when calling the
    `CreateReservation` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: RESTAURANT_CHECKS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to check information, for example, when calling the
    `RetrieveCheck` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: SETTLEMENTS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to settlement (deposit) information. For example, to call
    the Connect v1 ListSettlements endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: SUBSCRIPTIONS_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to subscription information. For example, to call the RetrieveSubscription
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: SUBSCRIPTIONS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to subscription information. For example, to call the CreateSubscription
    endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: TIMECARDS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to employee timecard information. For example, to call the
    Connect v2 SearchShifts endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: TIMECARDS_SETTINGS_READ
  description: |-
    __HTTP Method__: `GET`

    Grants read access to employee timecard settings information. For example, to
    call the GetBreakType endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: TIMECARDS_SETTINGS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to employee timecard settings information. For example, to
    call the UpdateBreakType endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: TIMECARDS_WRITE
  description: |-
    __HTTP Method__: `POST`, `PUT`, `DELETE`

    Grants write access to employee shift information. For example, to create
    and modify employee shifts.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: VENDOR_READ
  description: |-
    __HTTP Method__: `GET`, `POST`

    Grants read access to vendor information, for example, when calling the
    `RetrieveVendor` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml
- scope: VENDOR_WRITE
  description: |-
    __HTTP Method__:  `POST`, `PUT`, `DELETE`

    Grants write access to vendor information, for example, when calling the
    `BulkUpdateVendors` endpoint.
  flows:
  - authorizationCode
  sources:
  - openapi/square-openapi.yml