# Square setup and recovery

Use a Square production application with Bookings, Customers, Team, Catalog and Payments permissions. Save the access token and location, test the connection, sync services/staff, then configure the exact webhook URL displayed by Yatoon and its signature key.

## Verification checklist

- A website test booking appears in Square Calendar and POS.
- A Square-side edit/cancel returns to WordPress through the webhook.
- Team members only receive services they are qualified to perform.
- Availability honors Square hours, breaks, time off and existing appointments.
- **Sync & Logs** shows a recent successful sync and authenticated webhook.

Yatoon rejects unsigned webhooks, deduplicates event IDs, fetches current Square state after events, uses version-aware booking updates and stable idempotency keys, and retries failed background synchronization. For a 401/403, replace the expired token. For 429/5xx/network errors, leave automatic jobs enabled and retry from the recovery center after Square recovers. Never paste credentials into support tickets; use the redacted diagnostics export.

Payments and bookings are separate Square objects. If a payment succeeds but a later booking operation fails, verify the payment in Square before retrying and refund from Square Dashboard/POS when required by salon policy.