title: Can't save credit card using Square's Cards API - Error: Invalid Source-id
body: <p>I am trying to allow users to create monthly subscriptions via my website.</p>
  <p>To achieve the above, I've followed Square's suggested flow:</p>
  <ol>
  <li>Use Payments SDK to collect users card information client side and generate a token and source_id for the credit card in question.  This worked successfully.</li>
  </ol>
  <p>1.5 Create a customer and obtain a customer_id. success!</p>
  <ol start="2">
  <li><p>Use source_id from step 1 to create a payment and obtain a payment_id. This was successfully.</p>
  </li>
  <li><p>Use payment_id returned from step 2 to save the card on file. This calls results in in an error:</p>
  </li>
  </ol>
  <p><strong>This is the request sent in step 2:</strong></p>
  <p>public function createPayment($request)
  {</p>
  <pre><code>    $response = Http::withHeaders(
          [
              'Authorization' =&gt; &quot;Bearer &quot; . $this-&gt;config['square']['access_token'],
              'Content-Type' =&gt; 'application/json',
              'Square-Version' =&gt; &quot;2022-01-20&quot;,
          ]
      )-&gt;post($this-&gt;config['square']['paymentsEndpoint'], [
  
          &quot;idempotency_key&quot; =&gt; $request['source_id'],
          &quot;amount_money&quot; =&gt; [
              &quot;amount&quot; =&gt; $request['amount'],
              &quot;currency&quot; =&gt; &quot;USD&quot;,
          ],
          &quot;source_id&quot; =&gt; $request['source_id'],
          &quot;autocomplete&quot; =&gt; true,
          &quot;location_id&quot; =&gt; $this-&gt;config['square']['locationId'],
          &quot;reference_id&quot; =&gt; &quot;creator-id-&quot; . $request['id'],
  
      ]);
      $created = json_decode($response);
  
      if (isset($created-&gt;payment-&gt;id)) {
  
          return $created-&gt;payment-&gt;id;
      }
  }
  </code></pre>
  <p><strong>The above returns:</strong></p>
  <pre><code>{#1522
    +&quot;payment&quot;: {#1485
      +&quot;id&quot;: &quot;xmhTZnkyo9oZ9PH0eKdVfWwfvSJZY&quot;
      +&quot;created_at&quot;: &quot;2022-02-11T14:20:08.746Z&quot;
      +&quot;updated_at&quot;: &quot;2022-02-11T14:20:08.982Z&quot;
      +&quot;amount_money&quot;: {#1513
        +&quot;amount&quot;: 100
        +&quot;currency&quot;: &quot;USD&quot;
      }
      +&quot;status&quot;: &quot;COMPLETED&quot;
      +&quot;delay_duration&quot;: &quot;PT168H&quot;
      +&quot;source_type&quot;: &quot;CARD&quot;
      +&quot;card_details&quot;: {#1483
        +&quot;status&quot;: &quot;CAPTURED&quot;
        +&quot;card&quot;: {#1529
          +&quot;card_brand&quot;: &quot;VISA&quot;
          +&quot;last_4&quot;: &quot;1111&quot;
          +&quot;exp_month&quot;: 11
          +&quot;exp_year&quot;: 2023
          +&quot;fingerprint&quot;: &quot;sq-1-up5lr5N9rhqnx9-2Ho9ZGmb-6_ldGkuEsjOhgzaJ5Xhuv7Qqv0wCBhms-hMLTh-y0Q&quot;
          +&quot;card_type&quot;: &quot;CREDIT&quot;
          +&quot;prepaid_type&quot;: &quot;NOT_PREPAID&quot;
          +&quot;bin&quot;: &quot;411111&quot;
        }
        +&quot;entry_method&quot;: &quot;KEYED&quot;
        +&quot;cvv_status&quot;: &quot;CVV_ACCEPTED&quot;
        +&quot;avs_status&quot;: &quot;AVS_ACCEPTED&quot;
        +&quot;statement_description&quot;: &quot;SQ *DEFAULT TEST ACCOUNT&quot;
        +&quot;card_payment_timeline&quot;: {#1528
          +&quot;authorized_at&quot;: &quot;2022-02-11T14:20:08.856Z&quot;
          +&quot;captured_at&quot;: &quot;2022-02-11T14:20:08.982Z&quot;
        }
      }
      +&quot;location_id&quot;: &quot;LABQBPRYSFTE8&quot;
      +&quot;order_id&quot;: &quot;StJEDwNo1Q7eXeF0l8vD9Iaeac4F&quot;
      +&quot;reference_id&quot;: &quot;creator-id-1&quot;
      +&quot;risk_evaluation&quot;: {#1527
        +&quot;created_at&quot;: &quot;2022-02-11T14:20:08.856Z&quot;
        +&quot;risk_level&quot;: &quot;NORMAL&quot;
      }
      +&quot;total_money&quot;: {#1526
        +&quot;amount&quot;: 100
        +&quot;currency&quot;: &quot;USD&quot;
      }
      +&quot;approved_money&quot;: {#1525
        +&quot;amount&quot;: 100
        +&quot;currency&quot;: &quot;USD&quot;
      }
      +&quot;receipt_number&quot;: &quot;xmhT&quot;
      +&quot;receipt_url&quot;: &quot;https://squareupsandbox.com/receipt/preview/xmhTZnkyo9oZ9PH0eKdVfWwfvSJZY&quot;
      +&quot;delay_action&quot;: &quot;CANCEL&quot;
      +&quot;delayed_until&quot;: &quot;2022-02-18T14:20:08.746Z&quot;
      +&quot;application_details&quot;: {#1524
        +&quot;square_product&quot;: &quot;ECOMMERCE_API&quot;
        +&quot;application_id&quot;: &quot;sandbox-sq0idb-FrLggaZMvpJBc2UDN3zKlg&quot;
      }
      +&quot;version_token&quot;: &quot;mzLRfLZlX4n0M6DyXqkDeWqDx4nKy9zZM4Mz2UBlr9v6o&quot;
    }
  }
  </code></pre>
  <p><strong>Then this code calls the Cards endpoint to create a card:</strong></p>
  <p>public function createCard($request)
  {</p>
  <pre><code>    $id = auth()-&gt;user()-&gt;id;
      $user = User::find($id);
      $subscription = Subscription::where('user_id', '=', $id)-&gt;get();
  
      $response = Http::withHeaders(
          [
              'Authorization' =&gt; &quot;Bearer &quot; . $this-&gt;config['square']['access_token'],
              'Content-Type' =&gt; 'application/json',
              'Square-Version' =&gt; &quot;2022-01-20&quot;,
          ]
      )-&gt;post($this-&gt;config['square']['cardsEndpoint'], [
  
          &quot;idempotency_key&quot; =&gt; $request['source_id'],
          &quot;source_id&quot; =&gt; $request['source_id'],
          &quot;card&quot; =&gt; [
              &quot;billing_address&quot; =&gt; [
                  &quot;address_line_1&quot; =&gt; $subscription[0]['address_line_1'],
                  &quot;address_line_2&quot; =&gt; $subscription[0]['address_line_2'] ?? &quot;&quot;,
                  &quot;locality&quot; =&gt; $subscription[0]['admin_area_2'],
                  &quot;administrative_district_level_1&quot; =&gt; $subscription[0]['admin_area_1'],
                  &quot;postal_code&quot; =&gt; $subscription[0]['postal_code'],
                  &quot;country&quot; =&gt; $subscription[0]['country_code'],
              ],
              &quot;cardholder_name&quot; =&gt; $request['fullname'],
              &quot;customer_id&quot; =&gt; $request['customer_id'],
              &quot;reference_id&quot; =&gt; &quot;creator-id-&quot; . $request['id'],
          ],
      ]);
  
      return json_decode($response);
  
  }
  </code></pre>
  <p><strong>This call returns:</strong></p>
  <pre><code>{&quot;errors&quot;:[{&quot;category&quot;:&quot;INVALID_REQUEST_ERROR&quot;,&quot;code&quot;:&quot;INVALID_CARD_DATA&quot;,&quot;detail&quot;:&quot;Invalid card data.&quot;,&quot;field&quot;:&quot;source_id&quot;}]}
  </code></pre>
  <p>I tried running this in both sandbox and production environment and receive the same results.</p>
  <p>The card data used on the client side is as follows:</p>
  <ul>
  <li>Number: 4111 1111 1111 1111</li>
  <li>CVV: 111</li>
  <li>Postal code: 10003</li>
  </ul>
  <p>Alternatively, in regards to the card number, I have follow the following recommendation from the Subscription API and got the same result:</p>
  <p>Call CreateCard to add a card on file using the payment token (&quot;cnon:card-nonce-ok&quot;) that Square provides for Sandbox testing.</p>
  <p><strong>Can someone please help me figure this out?</strong></p>