Best practices for the OAuth "application server" - Square -

i have application uses personal access token access list of items. want switch using oauth, application use items_read only.

my application daemon running on instance of secure ubuntu server dedicated application(s). regarding "application server" there square recommends - typical best practices "application server"?

thank you

the api documentation extensive, , includes a helpful section oauth. few common pitfalls i've noticed oauth implementations in past lead me call these things out:

1. if building one-off integration own use, not worth using oauth.
2. make sure understand how oauth works. if find asking users' client secrets or personal access tokens, or else requires them open app management dashboard @ connect.squareup.com, need rethink implementation. you, developer, should need understand access tokens , other api credentials.
3. you can ask more oauth scopes bare minimum need. i'd recommend getting merchant_profile_read well. can useful manage accounts, , can hit /v1/me various ids you'll need.
4. the square oauth access tokens expire as described here. last thirty days, can tend creep on developers aren't aware of it. need use scheduled task renew access tokens expire , purge old tokens after doing so. simple cronjob should fine.

in terms of technology stack use, that's entirely you. square connect team happy , provide recommendations when can.