Why must Orders API require access to all sales history?

[vic18t]

Hi I have been working with a 3rd party using the Orders API and discovered they have full access to all of my sales history:

https://developer.squareup.com/reference/square/orders-api

I think this is a terrible implementation. Why must the merchant disclose all of their sales history to a 3rd party that is only pushing orders?

I already had a 3rd party tell me average total sales of my competitors who use the Orders API. I was curious how they knew this info, now I know.

This is a serious security flaw that merchants should be aware of.

[ashc]

Hey @vic18t,

I reached out to our API team for ya and got this response:

For “only pushing orders”, the developer (3rd party app) would only need ORDERS_WRITE permissions, assuming they’re using OAuth (which they should be). This means, they wouldn’t have access to read the orders. If the 3rd party app requested ORDERS_READ, the merchant would’ve been notified of all the permissions being requested before the merchant could accept (again, assuming they’re doing OAuth).

[vic18t]

Thank you Ashley!

It may be possible to Create Orders without Orders Read, but for a robust solution, the 3rd party would need some Read Access. For instance, reconciliation of an order that experienced a network error or for some reason the didn’t receive a JSON response from Square.

I think what is needed here is to limit the scope order history look-up similarly to how the Employee API is setup (I believe it has a 60 day limit option).

Can Square either add this date limiting feature and or limit order histories to only orders made by the 3rd party? The latter would be preferred. 

I know this would be a serious privacy issue if all merchants were made aware of this.

[ashc]

@vic18t I'm not trained in anything API related so I do apologize if i'm not addressing the question or if this makes sense but they also stated:

If they didn’t use OAuth, and instead gave the 3rd party their API credentials (which is common, but not the best way to do it), then, yes, they would have access to all of their API-related activities (sales, customers, etc). We do not recommend this approach, though.

[vic18t]

We are using OAuth.