AWS Deployment Guide

Step A Create Your Square Developer Account

# Square Credentials (copy these — you'll need them)
Application ID:   sq0idb-XXXXXXXXXXXXXXXXXXXXXXXX   ← used in browser JS (public)
Access Token:     EAAAl-XXXXXXXXXXXXXXXXXXXXXXXX   ← used in Lambda ONLY (secret!)
Location ID:      LXXXXXXXXXXXXXXXXX              ← found in Locations tab

Step B Configure Your Website Files

// In order.html — CONFIGURATION block
const SQUARE_APP_ID      = 'sq0idb-YOUR_ACTUAL_APP_ID';    ← from Square Dashboard
const SQUARE_LOCATION_ID = 'LXXXXXXXXXXXXXXXXX';            ← from Locations tab
const LAMBDA_ENDPOINT    = 'https://abc123.execute-api.us-east-1.amazonaws.com/process-payment'; ← your API Gateway URL (Step D)

<!-- SANDBOX (testing — current): -->
<script src="https://sandbox.web.squarecdn.com/v1/square.js"></script>

<!-- PRODUCTION (switch to this when live): -->
<script src="https://web.squarecdn.com/v1/square.js"></script>

Step C Deploy the Lambda Payment Processor

mkdir goals-payment-lambda && cd goals-payment-lambda
cp /path/to/lambda/process-payment.js ./index.js
npm init -y
npm install square
zip -r function.zip index.js node_modules/

# Lambda settings
Function name:   goals-process-payment
Runtime:         Node.js 20.x
Architecture:    x86_64
Memory:          256 MB
Timeout:         15 seconds
Handler:         index.handler

# Lambda Environment Variables
SQUARE_ACCESS_TOKEN  = EAAAl-YOUR_SECRET_ACCESS_TOKEN
SQUARE_LOCATION_ID   = LXXXXXXXXXXXXXXXXX
SQUARE_ENVIRONMENT   = sandbox          ← change to 'production' when live
ALLOWED_ORIGIN       = https://yourdomain.com   ← your website domain (CORS)

Step D Create API Gateway (HTTP API)

# API Gateway CORS Configuration
Allow origins:   https://yourdomain.com   ← your domain exactly
Allow methods:   POST, OPTIONS
Allow headers:   Content-Type
Max age:         300

# Example API Gateway endpoint
https://abc1defg23.execute-api.us-east-1.amazonaws.com/process-payment

Step E Test With Square Sandbox

# Square Sandbox Test Cards
Visa (success):       4111 1111 1111 1111   Exp: any future · CVV: any 3 digits
Mastercard (success): 5105 1051 0510 5100   Exp: any future · CVV: any 3 digits
Card declined:        4000 0000 0000 0002   (tests declined card flow)
Insufficient funds:   4000 0000 0000 9995   (tests insufficient funds)

Step F Go Live (Switch to Production)

aws s3 cp order.html s3://your-bucket-name/order.html
aws cloudfront create-invalidation --distribution-id YOUR_CF_ID --paths "/order.html"

Every time a buyer completes a purchase on order.html, their full order record is automatically saved to the GOALS order database (via the RESTful Table API). The Admin Dashboard at admin.html gives you a live view of all orders, buyers, revenue, and fulfillment status — all in one place, accessible from any browser.

Admin Dashboard Features

Order Data Captured Per Purchase

# Every order record stores:
order_number        → GOALS-123456 (auto-generated)
first_name          → Buyer's first name
last_name           → Buyer's last name
email               → Buyer's email (receipt sent here)
phone               → Buyer's phone (optional)
format              → Hardcover or Paperback
quantity            → Number of copies
unit_price          → Price per copy ($19.99 or $34.99)
total_amount        → Total charged (unit × qty)
signed_copy         → none / signed / personalized
personalization     → Inscription text (if personalized)
order_notes         → Buyer's additional notes
address_line1       → Street address
address_city        → City
address_state       → State / Province
address_zip         → ZIP / Postal code
address_country     → Country
status              → pending / paid / processing / shipped / delivered / cancelled
payment_status      → pending / completed / failed / refunded
square_payment_id   → Square transaction ID (e.g. RY9XXXXXXX)
square_receipt_url  → Link to buyer's Square receipt
tracking_number     → Shipping tracking (added by you after shipping)
fulfillment_notes   → Internal notes
shipped_at          → Timestamp when marked shipped
created_at          → Order placed timestamp

Accessing the Admin Dashboard

# Option A: Restrict admin.html via CloudFront signed URLs
aws cloudfront create-invalidation ...   ← use signed URLs / cookies

# Option B: IP whitelist via S3 bucket policy
# Block all IPs except your own from accessing admin.html
{
  "Condition": {
    "NotIpAddress": {
      "aws:SourceIp": ["YOUR.PUBLIC.IP.ADDRESS/32"]
    }
  }
}

# Option C (best): Move admin behind AWS Cognito authentication
# Use Amplify or Cognito User Pools for secure login