What information is shared with third-party APIs?

[vic18t]

[The title of this thread has been edited from the original: Security flaw with Square API?]

Hi, I currently have a 3rd party who is using the Square platform API to push orders to my registers from a self-serve kiosk. 

I found that they were able to access my entire sales history simply by being able to push orders to the register, and there is no way to block off their access without killing the order pushes.

This means that any 3rd party that pushes orders to a Square account will have access to your entire sales history - Postmates, Doordash, and others.

I think this is a serious privacy and security flaw. Getting order history should not be paired with pushing orders! There needs to be a separate permission option for pushing orders and getting orders.

Not happy about this and anyone who is using the api for orders need to be aware of this.

[PreOrder_Apps]

Whoa, really? Very good to know. 

[Alex_]

HI @vic18t,

Thank you for posting in the Seller Community.

Happy to provide a bit more insight on this. With Square and any third party integration, all activation and set-up is handled by the API on their side. Whenever Square integrates with a third party website or platform, Square will only see the payment information being processed from the card that was used during the transaction. We do not have any visibility into the actual back-end mechanics of linking the website to our payment system.

I highly recommend contacting the API to discuss what their terms an conditions state to see what you have allowed access to during initial set up.
 

[vic18t]

Hi Alex, I already did contact customer support, who did confirm that posting orders is shared with getting ALL orders, not just the ones transacted with the 3rd party. 

My 3rd party also confirmed this. 

I find it disingenuous that you would change the title of my thread when it is you who are misinformed.