Retrieving Authorization Code from Square - Proof of Concept

⚠️ THERE ARE INHERENT SECURITY RISKS IN USING THIS SOLUTION. Square recommends the use of a secure backend. Please see this Sandbox 101: OAuth Best Practices video on YouTube.

Background

A feature request was made on the Square Developer Forums to be allow direct retrieval of an OAuth authorization code without the use of an HTTPS server.

In this case, the user had a desktop application and wished not to deploy a web server for this process. OAuth protocol uses a callback requires the authorization server to redirect to a known link. Reference.

Solution for Windows

A solution would be to encapsulate the retrieval of the authorization code in a stand-alone web application running on the desktop that could be called by a desktop application. It is implemented in .NET 6.

The repository consists of:

• Web application
• Console Based Sample Application

Web Application

A minimal Web Api Application with an anonymous pipe for interprocess communication. The application is hosted in Kestrel a lightweight webserver built into .NET Core.

Console Based Sample Application

Demonstrates how an application could implement the initial part of the Square OAuth process and retrieve the Square Authorization code.

Getting Started

This guide assumes some familiarity with the Square Developer Dashboard.

• Clone this repository.

• Configure appsettings for web application with Square settings from Credentials page. Create an appsettings.development.json and appsettings.production.json using the appsettings.json provided as a template.

• Set the Redirect URL on OAuth page to https://localhost:5001/oauth-redirect.

• Build and run at the root of repository. A browser window will open at the Square OAuth page.

  dotnet build
  dotnet run --project .\ConsoleApp\