# Square and Pilotiko: your seller account linked, nothing automated

> Square and Pilotiko: the three OAuth permissions requested, how long tokens last, what stays manual today and how to revoke Pilotiko's access.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/square

Pilotiko can link your Square account today through OAuth with three permissions: PAYMENTS_READ, PAYMENTS_WRITE and MERCHANT_PROFILE_READ. It does not read any sale yet and creates no payment. Status: Account connection only: no automatic actions for now. Your in-person and online sales stay in Square.

## In short
- Status: Account connection only: no automatic actions for now.
- Permissions requested: PAYMENTS_READ, PAYMENTS_WRITE, MERCHANT_PROFILE_READ.
- Square access tokens expire after 30 days and are renewed with a refresh token.
- Sales reads, payments and refunds are not wired up.

## What does the Square connection do in Pilotiko?

It keeps, encrypted, the authorization you give Pilotiko on your Square seller account. No feature uses it yet.

Square often covers two jobs at once: the counter terminal and online payments. Pilotiko files Square under the Payments capability with a **connect-only** status: the authorization flow is built, but nothing that acts on your sales is. Pilotiko will not see a counter sale made Tuesday morning, and it cannot refund one either.

Square describes each permission by the endpoints it opens [1]. Pilotiko asks for three, listed below, with future payment collection and sales reconciliation in mind. Having asked for them does not mean they are used: no call is made to the Payments API or the Merchants API.

Square returns the token as JSON; the authorization code lasts 5 minutes and works once [2]. Pilotiko does not use PKCE with Square: the exchange happens server-side with the app secret.

- **PAYMENTS_READ**: reading payments, for example ListPayments or GetPayment [1]. Not used today.
- **PAYMENTS_WRITE**: creating, cancelling and refunding payments, for example CreatePayment or RefundPayment [1]. Not used today; any future use will wait for a person's approval.
- **MERCHANT_PROFILE_READ**: seller account and location details, for example ListLocations or RetrieveMerchant [1]. Not used today.

## How do I connect Square to Pilotiko?

The Square login that approves must be the business account. If Pilotiko has not switched on its Square app yet, the card says so and shows no button.

1. **Find the Square card** — In Pilotiko, Connections page, Payments group.
2. **Start the link** — Click Connect; Pilotiko prepares a one-time request, valid 10 minutes, tied to your business and to you.
3. **Read Square's consent screen** — Square lists the three permissions; make sure the right seller account is selected.
4. **Authorize** — Square sends you back to Pilotiko with a code; Pilotiko swaps it for a token and encrypts it.
5. **Check** — The card switches to Connected and notes that no automatic action takes place.

## What is available, being commissioned or coming soon with Square?

| Function | Status | Detail |
|---|---|---|
| Link the Square seller account | Account connection only: no automatic actions for now | Three permissions requested, token encrypted |
| Read counter and online sales | Coming soon | No Payments API call |
| Create a payment or refund | Coming soon | Will require a person's approval |
| Read your locations | Coming soon | No Merchants API call |
| Unlink Square in Pilotiko | Available | Tokens erased, audit log entry |

## What does Pilotiko see of a day of Square sales?

**Example: a hair salon with 2 locations and 41 Square sales on a Saturday**

The salon takes payments at the counter with Square in both locations and collects a few deposits online. Square has been linked to Pilotiko for a week.

- Counter sales (2 locations) : 35
- Deposits paid online : 6
- Sales read by Pilotiko : 0
- Locations read by Pilotiko : 0 of 2
- Refunds issued by Pilotiko : 0
- **= All 41 sales stay in Square; in Pilotiko, the day's bookings are not marked paid automatically.**

## How is your Square data protected under Law 25?

The Square token is encrypted at rest (AES-256-GCM) and never displayed, in the interface or in logs. Under Quebec's private-sector act, every business is responsible for the personal information it holds, and the person with the highest authority oversees compliance [3]. Today Pilotiko collects no Square sales data, so the token itself is the only thing to protect.

Once sales are read, they will include information about your customers; the act then gives people a right of access, including a copy in a structured, commonly used format on request [3]. More on [your rights](/en/your-rights) and our [subprocessors](/en/subprocessors).

Revoking: in Pilotiko, Disconnect erases the token and logs the action. In Square, the seller can revoke the app's access, which invalidates its tokens [2].

## What limits are specific to Square?

Square access tokens expire after 30 days [2]. A link left idle must be renewed with the refresh token or reconnected. No real Square account has been tried with Pilotiko yet, and the OAuth app is not registered.

For online-only payments, compare [Stripe](https://app.pilotiko.com/en/integrations/stripe); for a terminal from another brand, see [Clover](https://app.pilotiko.com/en/integrations/clover). Every connection is on the [Integrations](https://app.pilotiko.com/en/integrations) page, and your bookings can already come over from [Acuity Scheduling](https://app.pilotiko.com/en/integrations/acuity-scheduling) through migration.

## Frequently asked questions

### Does Pilotiko see the sales on my Square terminal?

Not yet. The read permission is requested, but no read is scheduled. Your sales are visible only in Square.

### Why ask for PAYMENTS_WRITE if Pilotiko creates no payment?

So payment collection can be switched on later without asking you again. No payment is created today, and any future one will wait for a person's approval.

### How long does the Square authorization last?

Square expires access tokens after 30 days and supplies a refresh token to get a new one. If renewal fails, the card switches to reconnect.

### Can I link several Square locations?

The link is made at the seller-account level, which groups its locations. Pilotiko does not read that list of locations yet.

### How do I cut Pilotiko's access to Square?

Click Disconnect in Pilotiko to erase the token. You can also revoke the app in Square, which invalidates its tokens.

### Will my customers notice anything at checkout?

No. Nothing changes in Square, at the counter or in your online payment links.

## Sources

1. Square Developer, « OAuth permissions reference », https://developer.squareup.com/docs/oauth-api/square-permissions (accessed on 2026-10-15)
2. Square Developer, « OAuth API overview », https://developer.squareup.com/docs/oauth-api/overview (accessed on 2026-10-15)
3. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)