Bolt.new AI and Square integration: Step-by-Step Guide 2025

Integrating Bolt.new with Square simply means: inside your Bolt.new project, you call Square’s real APIs using HTTPS requests or an official SDK, authenticate with a Square access token, and store that token in Bolt.new environment variables. Bolt itself is not a Square integration layer — you integrate Square the same way you would in any Node/React full‑stack app, just scaffolded, tested, and run inside Bolt’s browser environment.

 

What Integration Actually Looks Like

 

You use Square’s real REST API endpoints or SDKs. In Bolt’s backend (Node.js), you load your Square access token from an environment variable and make API calls (for example, create payments, read catalog items, manage customers, etc.). Bolt.new doesn’t auto-connect to Square — you wire it manually with standard API calls and authentication.

• Create a Square developer account and a sandbox application at developer.squareup.com.
• Get a Sandbox Access Token (this acts like a password that authorizes API calls).
• Store that token in Bolt.new’s environment variables so it’s not exposed in your code.
• Call Square’s REST API or use Square’s official Node SDK from your backend files.
• Test everything in Bolt’s preview server, then harden for production outside Bolt.

 

Environment Variables in Bolt.new

 

In Bolt.new, open the right panel → “Environment Variables” → create:

• SQUARE_ACCESS_TOKEN = your Square Sandbox Access Token
• SQUARE\_ENVIRONMENT = sandbox

Never hardcode secrets in your code — always use environment variables. This is how Bolt.new keeps your secrets isolated from the UI.

 

Example: Basic Node.js Backend Calling Square API

 

Below is a fully valid, real integration example using Square’s official Node SDK. This works in any Bolt.new backend.

// backend/squareClient.js
import { Client, Environment } from 'square';  // official SDK

// Load secrets from environment variables in Bolt.new
const client = new Client({
  accessToken: process.env.SQUARE_ACCESS_TOKEN,
  environment:
    process.env.SQUARE_ENVIRONMENT === "production"
      ? Environment.Production
      : Environment.Sandbox
});

export default client;

 

// backend/routes/payments.js
import express from 'express';
import squareClient from '../squareClient.js';

const router = express.Router();

router.post('/create-payment', async (req, res) => {
  try {
    // Example payload for a test payment
    const { amount } = req.body;

    const result = await squareClient.paymentsApi.createPayment({
      sourceId: "cnon:card-nonce-ok", // Square test nonce
      idempotencyKey: crypto.randomUUID(),
      amountMoney: {
        amount: amount, // in cents
        currency: "USD"
      }
    });

    res.json({ payment: result.result.payment });
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: err.message });
  }
});

export default router;

 

Frontend Example Calling Your Backend

 

// frontend/api.js
export async function createPayment(amount) {
  const response = await fetch('/api/create-payment', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ amount })
  });

  return await response.json();
}

 

Authentication Explained Simply

 

Square authenticates using a Bearer Access Token. When you use the Square SDK, it automatically attaches this token to every request. This token gives your backend permission to perform actions on your Square account. Because of this:

• Never expose the token to the frontend. Frontend code can be viewed by users.
• All Square operations must happen in the backend in Bolt.new.
• Use environment variables so the token never appears in your code repository.

 

Testing in Bolt.new Sandbox

 

Square provides “fake but real” test cards and payment methods you can use via their Sandbox. Bolt.new doesn’t simulate these — you’re talking to Square’s actual Sandbox servers over HTTPS. So when you click “Run” in Bolt.new, your app is performing real Square API calls.

• Test payments → appear in Square developer dashboard Sandbox.
• Create test orders → visible in Square Sandbox Orders.
• Create catalog items → visible in Sandbox Catalog.

 

Deploying Outside Bolt.new (Important)

 

Bolt.new is a browser workspace, not a hosting provider. Once your integration works, you deploy the Node backend somewhere real (Vercel, Render, AWS, etc.). At that point:

• Move your Square credentials into the platform’s environment variables.
• Switch from Sandbox token to Production token.
• Set SQUARE\_ENVIRONMENT to production.

The code itself won’t change, only the environment variables.

 

Summary

 

Integrating Bolt.new with Square is straightforward: use Square’s APIs or SDK inside your Bolt backend, authenticate via a Square access token stored in Bolt’s environment variables, and test using Square’s Sandbox. There is no special Bolt-specific integration — you’re just building a normal Node backend inside Bolt that talks to Square’s real servers over HTTPS.