Create or log into your Square Developer account and register an application in the Square Developer Dashboard.
Navigate to the Webhooks section for your application and create a new webhook subscription; provide your HTTPS endpoint URL.
Select the order event types you need: order.created fires when a new order is placed, order.updated fires when an order is modified, and order.fulfillment.updated fires when a fulfillment state changes.
Implement your webhook receiver endpoint to accept Square's POST requests; Square includes a signature in the request headers — validate the signature using your webhook signature key from the Dashboard to authenticate incoming events.
Parse the event payload to extract the order ID, location ID, order state, and line items; use the Order ID to call the Retrieve Order endpoint if you need the full order detail not included in the webhook body.
Respond with HTTP 200 within a few seconds; for processing-intensive workflows, acknowledge immediately and handle order logic asynchronously.
Known gotchas
Square webhook event payloads contain a summary of the event but may not include full order detail; you will typically need to make a follow-up Retrieve Order API call using the order ID from the event to get complete item and modifier data.
Square's webhook subscriptions are scoped to a developer application and must explicitly include each location ID you want events for; a new restaurant location will not automatically receive events until it is added to the subscription.
Square uses an application-specific webhook signature key that is separate from your application's OAuth tokens; store and rotate this key securely, and always validate signatures to prevent spoofed order events from being processed.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp