← Back to Skills Marketplace
7384
Downloads
3
Stars
0
Active Installs
17
Versions
Install in OpenClaw
/install squareup
Description
Square API integration with managed OAuth. Install only if you need Square administration. Connect with the least-privileged Square account and OAuth scopes available, verify the intended connection ID before each request, and revoke unused connections promptly. This integration can mutate Square data — approve only specific write actions after checking the exact endpoint, account, resource ID, and consequence. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key. Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Square connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Square action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Square examples; they add no Square capability - Square is not an event source, a trigger cannot read Square data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Usage Guidance
Install only if you want an agent to administer Square through Maton. Use the least-privileged Square account and OAuth scopes, verify the connection ID before requests, approve writes only after checking the exact endpoint/resource/amount, and treat functions, triggers, and destinations as persistent automation that should be reviewed and removed when no longer needed.
Capability Assessment
Credentials
Network access, Square OAuth, Maton credentials, and optional raw HTTP API-key use are proportionate to an API integration. The skill gives credential-handling guidance, prefers CLI-managed credentials, and says raw API keys should only be used when the CLI cannot be installed.
Install Mechanism
The artifact is markdown documentation with no executable files. Installation uses pinned Maton CLI instructions via npm or Homebrew, and the skill discloses required network access, a Maton account, and OAuth login.
Instruction Scope
The instructions default to read/list calls, require explicit user confirmation for connection creation and every write, require specific identifiers for financial or destructive actions, and treat third-party content as untrusted. Functions, triggers, destinations, and local --exec handling are documented with separate approval and scoping requirements.
Persistence & Privilege
The skill can create persistent Maton connections, hosted functions, triggers, and trigger destinations, but it frames those as explicit user-approved automation, recommends DENY_ALL network policy for functions, warns that destinations are ongoing forwarding channels, and provides deletion/revocation guidance. No hidden local persistence, startup hooks, or privilege escalation were found.
Purpose & Capability
The skill's purpose is Square administration through Maton OAuth/API gateway, and its documented capabilities include reading and modifying payments, refunds, customers, orders, catalog, inventory, invoices, cards, payouts, bank accounts, and terminal checkouts. That is high-impact business/financial access, but it is coherent with the stated purpose and repeatedly disclosed.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install squareup - After installation, invoke the skill by name or use
/squareup - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.2.5
Simplify the login instructions to the code flow (maton login prints a link; finish with maton login --code <CODE>), drop the API Key subsection, and pin the Maton CLI install to 0.4.0.
v1.2.4
Switch the login instructions to the device flow (maton login prints a link and a user code; the --oauth flag is gone) and pin the Maton CLI install to 0.3.5.
v1.2.3
Pin the Maton CLI install to 0.3.4, the current release.
v1.2.2
Add this skill's own trigger policy to the shared Triggers section: the only destination it sets up is its own hosted function inside the platform, it does not forward events to third-party hosts, and it does not use event watch --exec; each trigger reference now also says this skill configures no trigger from that source on its own.
v1.2.1
Bring the skill to the current api-gateway baseline and tell the connection-to-function-to-trigger story: the shared Functions and Triggers sections open with an example for this app (a hosted function that performs one action for it through the Maton SDK, and the trigger that runs it - its own event source where it has one, otherwise a time schedule), the description says these constructs turn the connection into automation and add no capability of their own, the passthrough is described by its enforced boundary, CLI and SDK installs are pinned to 0.3.1, absolute API URLs are placeholders, and multipart uploads use mktemp.
v1.2.0
CLI-first rewrite with the Maton SDK examples; clarify that the CLI and SDKs keep separate credential stores, and reword webhook egress warnings
v1.1.0
CLI-first rewrite: the maton CLI with OAuth login is the documented path, every example is a maton command, SDK examples added, and the raw HTTP fallback feeds the key on stdin instead of reading it from the environment
v1.0.9
- Removed the skill summary card file (skill-card.md).
- No functional or API changes; all usage and documentation remain the same.
- The update is a cleanup of redundant or unused documentation files.
v1.0.8
squareup 1.0.8
- Refined security and approval language to clarify that this integration mutates Square data, and emphasize explicit approval for each write action.
- Shortened and clarified the description and introductory notes for easier reading.
- Trimmed detailed feature lists in the introduction; now directs users to the API Reference for supported endpoints.
- Strengthened language on least-privilege, account selection, and resource verification before write operations.
- No functional changes to API endpoints or usage.
v1.0.7
- Clarified the base URL usage to ensure only documented API endpoints are supported—arbitrary endpoint paths are no longer accepted.
- Added a prominent security note under Authentication emphasizing the importance of treating the API key as a secret and including rotation instructions.
- Updated the proxy description to clarify request flow and endpoint restrictions.
- No functional or code changes; documentation only.
v1.0.6
- Clarified and strengthened the description with more direct security and usage guidance.
- Emphasized that all write operations require explicit user approval, showing the exact endpoint, resource, and consequences.
- Recommended using the least-privileged Square account/scopes and verifying connection IDs before each request.
- Streamlined language for admin-focused installation and advised promptly revoking unused connections.
- No changes to API endpoints or functionality.
v1.0.5
- Clarified that this skill has write capability for Square business data, including financial and operational actions.
- Updated description and security section to emphasize explicit user approval is required for all create, update, and delete operations, with verification of specific resources and effects.
- Enhanced guidance to default to read-only actions, requiring confirmation and summary of consequences before performing sensitive operations.
- Warned about the breadth of account access, urging least-privilege and prompt OAuth revocation when not needed.
- No changes to API endpoints or core functionality.
v1.0.4
- Switched all documentation and API endpoints from gateway.maton.ai/ctrl.maton.ai to api.maton.ai.
- Updated instructions for connection management and quick start to use the new api.maton.ai URLs.
- Clarified usage of the Maton-Connection header and recommended always including it when multiple Square connections exist.
- Added a new Security & Permissions section with guidance on user approval for write operations.
- Removed the LICENSE.txt file.
v1.0.3
- Expanded description to include support for loyalty programs, team members, and payment links.
- Updated usage guidance to reflect new Square API capabilities.
- No code changes; documentation only.
v1.0.2
- Added metadata field for "clawdbot" specifying an emoji and required environment variable.
- Now explicitly documents that MATON_API_KEY must be set as an environment variable.
- No changes to functionality or API; documentation and metadata update only.
v1.0.1
- No user-facing changes in this version.
- Internal SKILL.md file was updated only; there are no functional or documentation changes visible to users.
v1.0.0
Initial release of Square API integration skill.
- Provides access to Square API for payments, customers, orders, catalog, inventory, and invoices.
- Supports managed OAuth authentication and connection management via Maton.
- Includes sample code for Python to list locations and manage OAuth connections.
- Covers usage of the Maton API key and specifying active Square connections.
- Detailed API reference for common Square endpoints and operations.
- Designed for point-of-sale, payment processing, inventory, and invoicing workflows through Square.
Metadata
Frequently Asked Questions
What is Square?
Square API integration with managed OAuth. Install only if you need Square administration. Connect with the least-privileged Square account and OAuth scopes available, verify the intended connection ID before each request, and revoke unused connections promptly. This integration can mutate Square data — approve only specific write actions after checking the exact endpoint, account, resource ID, and consequence. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key. Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Square connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Square action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Square examples; they add no Square capability - Square is not an event source, a trigger cannot read Square data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe). It is an AI Agent Skill for Claude Code / OpenClaw, with 7384 downloads so far.
How do I install Square?
Run "/install squareup" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Square free?
Yes, Square is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Square support?
Square is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Square?
It is built and maintained by byungkyu (@byungkyu); the current version is v1.2.5.
More Skills