'production', // Square Application credentials for your platform app (Dashboard → your app // → Credentials; flip the Sandbox/Production toggle to match 'env' above). // - client_id IS the Application ID. Production: sq0idp-... Sandbox: the // Sandbox Application ID (sandbox-sq0idb-...). This SAME value is used as // the Web Payments SDK appId on the frontend (see web_payments_app_id). // - client_secret is the OAuth Application Secret. Production: sq0csp-... // Sandbox: sandbox-sq0csb-... 'client_id' => 'sq0idp-gx2ebQJw0LVnELCNf7jaPA', // OAuth Application Secret (sandbox-sq0csb-...), from the dashboard's OAuth page. // Only needed for OAuth onboarding (onboard.php) — NOT for the local charge test. // NOTE: the EAAA... value you had here was your Sandbox ACCESS TOKEN, which is // not the OAuth secret — use that access token as the seed helper's --token. 'client_secret' => 'sq0csp-U1L2aDIsPDf7ix7hYfN4v2zrklxn4-6Q2tlDHg916YY', // Web Payments SDK application id used by the browser to tokenize cards. This // is the public Application ID and is normally identical to client_id, so we // default to it. Only set this if your frontend must use a different app id. 'web_payments_app_id' => '', // OAuth permissions we request from each seller (space-joined in the URL). // PAYMENTS_WRITE/READ -> charge cards + read payments on the seller's behalf // MERCHANT_PROFILE_READ -> read merchant + locations (needed to verify readiness) // PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS -> REQUIRED to take app_fee_money (your // platform cut). Only needed if platform_fee.enabled is true below; if you // turn fees on you must add it here AND have sellers re-authorize. // Changing scopes requires sellers to re-authorize. 'scopes' => [ 'MERCHANT_PROFILE_READ', 'PAYMENTS_WRITE', 'PAYMENTS_READ', 'PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS', // uncomment to take app fees ], // The OAuth redirect URL. Leave BLANK (recommended): Square then returns every // school to the "Redirect URL" registered in the Square Developer Dashboard, // which must be https:///square/onboard.php (e.g. // https://app.hotlunches.net/square/onboard.php). If you do set it, it must // match the dashboard value byte for byte (scheme, host, and path). 'redirect_uri' => 'https://dev.hotlunches.net/square/onboard.php', // When true, the authorize URL sends session=false, forcing Square to show the // seller LOGIN screen every time. Square REQUIRES this for production apps so a // school admin who is already signed into a different Square account (e.g. a // personal one) cannot connect the wrong account by accident. // ⚠️ Set FALSE in Sandbox — the sandbox authorize page can't render a login and // returns 400 when session=false is sent. 'oauth_force_login' => true, // Base URL used by browser redirects (auto-detected; override via SQUARE_BASE_URL env if needed) 'base_url' => $computedBaseUrl, // Master switch for moving money. When false, order-api.php validates the // request but does NOT charge (returns stage:"validated") — useful to deploy // the frontend before you're ready to take live payments. 'payments_enabled' => true, // When true, order-api.php rejects a charge whose browser Origin is not in // the school's registered embed allowlist (schools.square_allowed_origins). // Leave false until every connected school has registered // the domain(s) their "Pay" button lives on, or legitimate buttons may be // blocked. A first-party call with no Origin header is always allowed. 'enforce_embed_origins' => false, // Your platform's per-transaction cut, taken via Square's app_fee_money. // fee = round(amount * percentage / 100) + fixed_cents // DEFAULT OFF. To enable: set enabled=true, add the // PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS scope above, have sellers re-authorize, // and ensure your app is approved by Square to take app fees. The fee is // capped at 90% of the amount (Square's limit) and must use the same currency. 'platform_fee' => [ 'enabled' => false, 'percentage' => 0.0, // e.g. 2.0 for 2% 'fixed_cents' => 0, // e.g. 30 for $0.30 ], // API version sent on every request (the date-based Square-Version header). // Pin this so a future API change can't silently alter behavior; bump it // deliberately after reviewing the changelog. 'square_version' => '2026-05-20', // Storage path (must be writable by Apache/PHP) 'storage_path' => __DIR__ . DIRECTORY_SEPARATOR . 'data', // Key used to encrypt seller access/refresh tokens at rest (AES-256-GCM). // Generate one once with: php -r "echo bin2hex(random_bytes(32));" // and paste the 64-hex-char string here (or set the SQUARE_TOKEN_KEY env var). // If left empty, tokens are stored in PLAINTEXT and a warning is logged — do // not ship to production without a key. 'token_encryption_key' => getenv('SQUARE_TOKEN_KEY') ?: '296dfee5fbf2f334b542c982eed54384d670fc9aef6c896ab8e18317caf029b2', // CA bundle for cURL TLS verification. Some environments (notably Windows // PHP builds) ship without a configured curl.cainfo, which makes every // HTTPS call to Square fail with "unable to get local issuer certificate". // We bundle a Mozilla CA file next to this config and use it when present; // on servers with a system bundle already configured this is simply ignored. 'curl_ca_bundle' => is_file(__DIR__ . '/cacert.pem') ? __DIR__ . '/cacert.pem' : null, // Webhook signature key from Square Dashboard → your App → Webhooks. // Used to verify the x-square-hmacsha256-signature header on incoming events // such as oauth.authorization.revoked. 'webhook_signature_key' => 'KszGraQZC-6Bkidoz1Fd_A', // The EXACT Notification URL registered for the webhook subscription. Square's // signature is computed over (this URL + raw body), so it must match byte for // byte (e.g. https://app.hotlunches.net/square/webhook.php). If left blank, // webhook.php reconstructs it from the request, which can break behind a proxy. 'webhook_url' => 'https://app.hotlunches.net/square/webhook.php', ];