Square API
Square exposes 20-plus REST APIs and GraphQL, over 100 endpoints from Payments to Inventory, all self-serve with a free sandbox. Auth is OAuth 2.0 with scoped permissions or personal access tokens. Rate limits are undisclosed; apps see API_RATE_LIMIT_EXCEEDED without published numbers.
Frequently asked questions
Square scores A on the API Report Card. Square exposes 20-plus REST APIs and GraphQL, over 100 endpoints from Payments to Inventory, all self-serve with a free sandbox. Auth is OAuth 2.0 with scoped permissions or personal access tokens. Rate limits are undisclosed; apps see API_RATE_LIMIT_EXCEEDED without published numbers.
Square has a workable official integration path. Most engineering teams can build against it directly. Open API: self-serve, documented, with SDKs
Square is the seller-facing business of Block, Inc. (NYSE: XYZ, formerly SQ), the public company founded in 2009 by Jack Dorsey and Jim McKelvey and headquartered in Oakland, California.
Vertical: Financial Services (SMB payments, POS and embedded banking). Card-present payments: Tap, dip and swipe via Square Reader / Terminal / Register / Stand / Kiosk hardware and the Mobile Payments SDK..
High, top-tier coverage in any SMB-commerce or payments-unification ICP. Square is the most-installed SMB POS in the US and a top-three SMB acquirer globally.
Square processes and stores extensive financial, transactional and personal data on behalf of millions of SMB sellers.
Founded 2009 (Block, Inc. went public 2015).
Webhook delivery is at-least-once with up to 11 retries over 24 hours, handlers must be idempotent; Square recently shortened the retry window from 48h/19 attempts to 24h/11. Order and Payment webhooks can arrive out of order or duplicated, particularly during high-volume promotional periods. Full sourced list under Sources below.
Common alternatives include Toast, Clover (Fiserv), Lightspeed, Shopify POS, Stripe (Terminal + Payments), PayPal Zettle / Braintree. Graded alternatives appear under "More from the report card" below.
Grades measure one thing: can a customer's engineering team get their own data out programmatically? We check six things (whether a real API exists, how access is gated, data coverage, auth quality, docs and developer experience, and stability) and roll them into a letter grade. Grades get re-verified, and they only move on evidence.