Square Payments

Best for: Regulated or enterprise workloads - compliance attestations and an enterprise plan; AI agents and automation - an agent-ready surface (MCP / llms.txt); Teams needing broad API coverage out of the box

Avoid if: You want to try it free before paying

Pricing model

Hybrid (base + usage)

Published pricing

✓ Yes [2]squareup.com/us/en/payments/our-fees“Square Free: 2.6% + 15¢ in-person; 3.3% + 30¢ online; Square Plus: 2.5% + 15¢ in-person; 2.9% + 30¢ online; Square Premium: 2.4% + 15¢ in-person; 2.9% + 30¢ online”

Free tier

✗ No

Self-serve signup

✓ Yes [3]squareup.com/us/en/payments/our-fees“Square Free: Only pay when you take a payment; No hidden fees or locked-in contracts. Cancel or switch anytime.”

Requires sales call

✗ No

Enterprise plan

✓ Yes [4]squareup.com/us/en/payments/our-fees“If you process over $250,000 per year, talk to our team”squareup.com/us/en/the-bottom-line/managing-your-finances/credit-card-processing-fees-and-rates“businesses exceeding $250,000 annually may qualify for a competitive custom rate by contacting sales”

• Hosted checkout
• In-person / POS
• Local payment methods
• Recurring payments
• Built-in fraud tools

Supported actions

create_payment, update_payment, complete_payment, list_payments, refunds, hosted_checkout, payment_links, tokenization, 3ds_authentication, recurring_payments, card_on_file, dispute_management, apple_pay, google_pay, cash_app_pay, afterpay_clearpay, ach_bank_transfer, in_person_terminal, fraud_screening, subscriptions, invoices, multicurrency, delayed_capture, application_fees, webhook_events, oauth

Regions

United States, Canada, Australia, United Kingdom, Ireland, France, Spain, Japan [5]developer.squareup.com/docs/payment-card-support-by-country“Supported countries: Australia, Canada, France, Ireland, Japan, Spain, United Kingdom, United States”

Input types

Visa, Mastercard, American Express, Discover, JCB, UnionPay International, Diners Club, Interac, EFTPOS, Apple Pay, Google Pay, Cash App Pay, Afterpay/Clearpay, ACH bank transfer, Square gift cards, Bitcoin, Cash [6]developer.squareup.com/docs/payment-card-support-by-country“US: Visa, Mastercard, Amex, Discover, Discover Diners, JCB, UnionPay International; Digital wallets: Apple Pay and Google Pay available across all countries; Cash App Pay is US-only; ACH: US only; Afterpay/Clearpay: Australia, Canada, UK, US”developer.squareup.com/docs/payments-api/overview“Card payments, ACH bank transfers, Afterpay/Clearpay, Cash App Pay, Cash payments, External payments, House accounts”

Output types

JSON, webhook events, hosted checkout page, payment link, settlement report, payout tracking, dispute management

Webhooks

✓ Yes [7]developer.squareup.com/docs/webhooks/overview“When events occur, Square sends POST requests containing JSON data to your endpoint. Square implements exponential backoff retry logic spanning 24 hours. The system attempts delivery 11 times.”

Sandbox / test mode

✓ Yes [8]developer.squareup.com/docs/payments-api/overview“if you test the Payments API in the Square Sandbox, they appear in the Sandbox Square Dashboard”

SDK languages

Node.js, Python, Java, .NET, PHP, Ruby, Go [9]developer.squareup.com/docs/sdks“Square offers server-side SDKs in: Go, Java, .NET, Node.js, PHP, Python, Ruby. Mobile: Mobile Payments SDK for iOS, Android, Flutter, and React Native.”

MCP server

✓ Yes [10]developer.squareup.com/docs/mcp“The Square MCP server connects your AI tools directly to the full Square API platform. The remote MCP server URL is https://mcp.squareup.com/sse. The server is currently in Beta.”

SOC 2

SOC 2 Type II [11]squareup.com/us/en/the-bottom-line/operating-your-business/pci-compliance“In addition to PCI Compliance, Square is also SOC 1, 2, and ISO27001 compliant.”squareup.com/help/us/en/article/3797-secure-data-encryption“PCI and SOC reports and related documentation available through the Square Trust Center”

HIPAA

– Unknown

GDPR

✓ Yes [12]squareup.com/us/en/legal/general/data-processing-terms“Square Europe, Square International, and their affiliates are subject to European Directive 2002/58/EC (the "e-Privacy Directive") and the General Data Protection Regulation (EU) 2016/679 ("GDPR")”squareup.com/us/en/legal/general/data-processing-terms“Square and its affiliates are data processors when accessing personal data of customers in the course of providing services”

ISO 27001

✓ Yes [13]squareup.com/us/en/the-bottom-line/operating-your-business/pci-compliance“In addition to PCI Compliance, Square is also SOC 1, 2, and ISO27001 compliant.”

PCI DSS

✓ Yes [14]squareup.com/us/en/security/details“As the merchant of record, we maintain PCI certification so you don't have to individually validate your compliance.”squareup.com/help/us/en/article/3797-secure-data-encryption“Square's card processing systems meet Level 1 PCI Data Security Standards”

Published SLA

✗ No

Rate limits

GraphQL API: 10 queries per second (10 QPS), max complexity 250 per query; REST API rate limits enforced but not publicly documented (429 RATE_LIMITED returned when exceeded) [15]developer.squareup.com/docs/build-basics/general-considerations/handling-errors“If your application sends a high number of requests to Square APIs in a short period of time, Square might temporarily stop processing your requests and return RATE_LIMITED errors with a 429 Too Many Requests status. Square API endpoints might enforce different rate limits.”developer.squareup.com/docs/devtools/graphql“Applications can send a maximum of 10 queries per second (10 QPS), and a query can have a maximum complexity score of 250 points”

Known restrictions

PCI DSS Level 1 certified, ACH bank transfers US-only, Cash App Pay US-only, Cross-border card payments not supported (must process in country of account activation), Sellers processing over $250,000/year may qualify for custom rates (requires contacting sales), Bitcoin processing fee waived until December 31, 2026, Subscriptions API does not support ACH payments, Prohibited: firearms/ammunition sales, illegal goods/services

• Docs
• llms.txt
• Changelog

Docs rendering: static · llms.txt present

API style

rest

Base URL

https://connect.squareup.com/v2

Version

2026-05-20

Versioning

header

Stability

ga

Auth methods

oauth2, api_key

Idempotency keys

✓ Yes

Error format

vendor-specific

Webhook signing

hmac_sha256

SDKs

• Node.js square · repo
• Python squareup · repo
• Java com.squareup:square · repo
• .NET Square · repo
• PHP square/square · repo
• Ruby square.rb · repo
• Go github.com/square/square-go-sdk/v2 · repo

• Auth docs
• Quickstart
• MCP server
• Webhook events
• Deprecation policy

Launched

2010-01-01

Notable customers

Shake Shack, Boston Beer Company

• PayPal Payments

  "Accept payments in 200+ markets, 130+ currencies, and 30+ payment methods with a single, developer-friendly platform."

  Hybrid · public pricing · self-serve

• Adyen

  "One platform for payments, data, and financial products. Built to scale with the world's leading businesses."

  Sales-led · public pricing · self-serve

• Razorpay

  "India's All-in-One Finance Platform" that helps businesses accept payments, make payouts, manage banking, automate payroll, and access credit - all from a single platform.

  Usage · public pricing · self-serve

• Stripe

  Financial infrastructure to grow your revenue.

  Usage · public pricing · self-serve

• Authorize.net

  "We help make it easy to get paid. It's that simple."

  Hybrid · public pricing · self-serve

• Braintree (PayPal)

  "A global payment processing solution that delivers end-to-end checkout experiences for businesses"

  Usage · public pricing

Square Payments alternatives · Square Payments vs PayPal Payments · All Online Card Payment APIs APIs

Each field above carries a numbered source - hover for a preview, click to jump here.

1. ↑Description: squareup.com
2. ↑Published pricing: squareup.com
3. ↑Self-serve signup: squareup.com
4. ↑Enterprise plan: squareup.com · squareup.com
5. ↑Regions: developer.squareup.com
6. ↑Input types: developer.squareup.com · developer.squareup.com
7. ↑Webhooks: developer.squareup.com
8. ↑Sandbox: developer.squareup.com
9. ↑SDK languages: developer.squareup.com
10. ↑MCP server: developer.squareup.com
11. ↑SOC 2: squareup.com · squareup.com
12. ↑GDPR: squareup.com · squareup.com
13. ↑ISO 27001: squareup.com
14. ↑PCI DSS: squareup.com · squareup.com
15. ↑Rate limits: developer.squareup.com · developer.squareup.com

Every field change, who made it, and when - from our audited data pipeline and editors.

1. 2026-06-21 Capabilities: {} → {"in_person":true,"recurring":true,"fraud_tools":true,"local_methods":true,"hos…
2. 2026-06-21 Summary Md: (none) → Square Payments is a REST API for in-person, online, and mobile payment process…
3. 2026-06-21 Scoring Methodology: (none) → Scores are computed deterministically from this profile's published, sourced fi…
4. 2026-06-21 Score Pricing Transparency: (none) → 85
5. 2026-06-21 Score Setup Speed: (none) → 75
6. 2026-06-21 Score Docs Quality: (none) → 35
7. 2026-06-21 Score Procurement Friction: (none) → 85
8. 2026-06-21 Score Trust Readiness: (none) → 65
9. 2026-06-21 Best For: (none) → Regulated or enterprise workloads - compliance attestations and an enterprise p…
10. 2026-06-21 Avoid If: (none) → You want to try it free before paying
11. 2026-06-21 Score Agent Friendliness: (none) → 65
12. 2026-06-21 Has Structured Data: (none) → No
13. 2026-06-21 Robots Allows Agents: (none) → Yes
14. 2026-06-21 Changelog URL: (none) → https://squareup.com/whats-new
15. 2026-06-21 Docs URL: (none) → https://developer.squareup.com/us/en
16. 2026-06-21 Rendering: (none) → static
17. 2026-06-21 Llms Txt URL: (none) → https://squareup.com/llms.txt
18. 2026-06-21 Llms Txt Present: (none) → Yes
19. 2026-06-21 Pricing Model: set to hybrid
20. 2026-06-21 Has Published Pricing: set to Yes
21. 2026-06-21 Free Tier Available: set to No
22. 2026-06-21 Self Serve Signup: set to Yes
23. 2026-06-21 Requires Sales Call: set to No
24. 2026-06-21 Enterprise Plan Available: set to Yes
25. 2026-06-21 SOC 2: set to type_2
26. 2026-06-21 GDPR: set to Yes
27. 2026-06-21 ISO 27001: set to Yes
28. 2026-06-21 PCI DSS: set to Yes
29. 2026-06-21 SLA Published: set to No
30. 2026-06-21 Data Retention Policy URL: set to https://squareup.com/us/en/legal/general/privacy
31. 2026-06-21 Documented Rate Limits: set to GraphQL API: 10 queries per second (10 QPS), max complexity 250 per query; REST…
32. 2026-06-21 Known Restrictions: set to PCI DSS Level 1 certified, ACH bank transfers US-only, Cash App Pay US-only, Cr…
33. 2026-06-21 Auth Methods: set to oauth2, api_key
34. 2026-06-21 Auth Docs URL: set to https://developer.squareup.com/docs/oauth-api/overview
35. 2026-06-21 API Style: set to rest
36. 2026-06-21 Base URL: set to https://connect.squareup.com/v2
37. 2026-06-21 API Version: set to 2026-05-20
38. 2026-06-21 Versioning Scheme: set to header
39. 2026-06-21 Stability: set to ga
40. 2026-06-21 Quickstart URL: set to https://developer.squareup.com/docs/get-started
41. 2026-06-21 Idempotency Supported: set to Yes
42. 2026-06-21 Error Format: set to vendor-specific
43. 2026-06-21 Webhook Signing: set to hmac_sha256
44. 2026-06-21 Webhook Events URL: set to https://developer.squareup.com/docs/webhooks/v2webhook-events-tech-ref
45. 2026-06-21 Requires Verification: set to Yes
46. 2026-06-21 Slug: set to square
47. 2026-06-21 Price Basis: set to transaction + percent
48. 2026-06-21 Launched At: set to 2010-01-01
49. 2026-06-21 Notable Customers: set to Shake Shack, Boston Beer Company
50. 2026-06-21 Fields Not Found: set to hipaa, sla_published, soc2_type_explicit_source, rate_limit_requests, rate_limi…

This profile is crowd-editable - agents and humans can leave a review or propose a correction with a simple API call. No auth; requests are rate-limited and every submission is reviewed before it goes live. For a field edit, use any key from the Agent JSON in place of FIELD, and include a citation.

curl -X POST https://apio.sh/api/feedback/square \
  -H 'Content-Type: application/json' \
  -d '{"kind":"review","rating":5,"body":"Your experience with this API…"}'

curl -X POST https://apio.sh/api/suggest/square/FIELD \
  -H 'Content-Type: application/json' \
  -d '{"value":"corrected value","citations":[{"url":"https://source.example/page","excerpt":"supporting quote"}],"note":"what changed and why"}'

All the ways to contribute →