Square Saved Card Recovery and Gateway for WHMCS

What does the Square card recovery module do?

When WHMCS loses its stored payment methods through a bad restore, a failed migration or a damaged table, the cards are usually not gone. Square still has every card on file, and those tokens still work. What was lost is the link between each Square card and a WHMCS client. This module rebuilds that link and writes the cards back as proper WHMCS pay methods, so automatic billing can charge them again.

It recovers tokens, not card numbers. Square never returns a full card number or security code to anyone, so what comes back is the card token, brand, last four digits, expiry month and year, and the cardholder name and billing address. That is enough to charge the card through Square again. It is not enough to move the cards to another processor.

How does a recovery run?

Matching uses the WHMCS client ID stored in Square, the client email and contact emails; looser signals such as phone, company and name are off by default. A customer is matched on its own only at a score of 90 or more, and two candidates within ten points of each other always go to review. Automatic restore stays off until you switch it on. Expired and disabled cards are reported rather than restored, cards a client already has are not duplicated, and one client can be recovered on its own for a single support ticket.

How does the Square gateway take payments?

New cards go into Square's hosted card form, so card numbers travel from the browser to Square and never touch your server, and Strong Customer Authentication runs on payments. Renewals charge saved cards as merchant-initiated payments, and refunds start from the WHMCS invoice. Invoices are marked paid only from signed callbacks, Square webhooks checked with HMAC-SHA256, or a cron check against the Square API for payments still pending, and a transaction ID check stops any payment being applied twice. When Square reissues a card, the existing pay method takes the new token instead of gaining a second card.

Who is it for, and what do you need?

Hosting companies that bill through Square and found their saved cards missing after a restore or a move, and anyone who wants a Square gateway with a recovery path built in. Requirements: WHMCS 8.x (I confirm the exact version with you at purchase), PHP 7.4 or newer with cURL and OpenSSL, a cron job every five minutes, and a Square access token, application ID and location ID whose currency matches your invoices.

Limits: only cards Square still holds can be restored, and a card whose issuer asks the cardholder to authenticate cannot be charged unattended. I also sell a plain Square gateway; if your saved cards are intact, that is the smaller purchase.

It costs $199 once for a lifetime license with twelve months of updates and support, an instant download and license key, and a seven-day refund window.