QuickBooks Online API: Complete Developer Guide for 2026

The QuickBooks Online (QBO) API is the primary interface for programmatically interacting with Intuit’s cloud accounting platform.

Whether you’re building a SaaS integration, automating invoice workflows, or syncing financial data between systems, this API is the backbone of the QuickBooks ecosystem.

Does QuickBooks Online Have an API?

Yes. QuickBooks Online provides a REST-based Accounting API that developers can use to read and write accounting data such as:

• Customers
• Invoices
• Payments
• Bills
• Vendors
• Accounts
• Journal entries
• Items
• Purchase transactions

The API uses OAuth 2.0 for authentication and is the primary API for applications integrating directly with QuickBooks Online accounting data.

QuickBooks Payments and QuickBooks Desktop use separate APIs and integration methods.

TL;DR Quick Start

QuickBooks Online API Updates in 2026

QuickBooks Online developers should account for several API and developer-platform changes when building or maintaining integrations in 2026.

Minor Version 75 Is the Current Baseline

Since August 1, 2025, QuickBooks Online Accounting API requests using minor versions 1 through 74 are handled using minor version 75.

Applications should therefore:

• Be compatible with minor version 75
• Avoid relying on older response structures
• Be designed to tolerate future schema additions

OAuth Refresh Tokens Now Have a Maximum Lifetime

QuickBooks OAuth refresh tokens should no longer be treated as indefinitely renewable credentials.

Intuit has introduced a maximum five-year lifetime for refresh tokens.

Developers should:

• Store the latest refresh token returned during renewal
• Track authorization expiration
• Provide users with a reconnection process
• Configure the Reconnect URL in the Intuit Developer Portal

QuickBooks Webhooks Now Use CloudEvents

QuickBooks Online webhook notifications have moved to the CloudEvents format.

Applications using the previous webhook payload structure should update their event-handling logic to support CloudEvents.

Reports API Responses Have Changed

QuickBooks has also modernized its Reports API infrastructure.

Applications processing financial reports should avoid relying on fixed row positions and account for changes involving:

• Null values
• Account hierarchy
• Summarization
• Response formatting
• Supported reports

API Usage Includes Core and CorePlus Calls

Intuit’s App Partner Program categorizes API activity into Core and CorePlus usage

CorePlus usage is subject to monthly allowances based on the developer’s partner tier.

QuickBooks Online API Overview: How It Works

The QuickBooks Online API is a REST API that uses JSON for request and response payloads (XML is also supported but deprecated for most use cases).

Architecture at a Glance

Available SDKs

Intuit provides official SDKs that handle OAuth token management, request signing, and serialization:

What Is the Best API for QuickBooks Online?

For applications that need to read or write accounting data, the QuickBooks Online Accounting API is the primary API to use.

If your application needs customers, invoices, payments, bills, journal entries, accounts, or financial reports from QuickBooks Online, the Accounting API is generally the appropriate starting point.

QuickBooks Online API Official Documentation & Developer Resources

Intuit provides several official resources for developers building with the QuickBooks Online API.

This guide complements the official Intuit documentation by explaining how authentication, endpoints, synchronization, rate limits, webhooks, and production considerations work together in a real-world QuickBooks integration.

How to Authenticate with QuickBooks Online API Using OAuth 2.0

Step 1: Register Your App

Go to the Intuit Developer Portal (developer.intuit.com), create an account, and register a new app. You’ll receive:

• Client ID (also called Consumer Key)
• Client Secret (also called Consumer Secret)

Configure your redirect URI this is where Intuit sends the authorization code after the user grants access.

Before going live, developers should also understand the full app setup process inside the Intuit Developer Portal.

Step 2: Authorization Request

Redirect the user to Intuit’s authorization endpoint:

https://appcenter.intuit.com/connect/oauth2?
  client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=com.intuit.quickbooks.accounting
  &state=YOUR_CSRF_TOKEN

Scopes available:

• com.intuit.quickbooks.accounting Full access to accounting data
• com.intuit.quickbooks.payment Access to payment processing
• openid profile email User identity information

Step 3: Exchange Authorization Code for Tokens

After the user authorizes, Intuit redirects to your redirect URI with an authorization_code. Exchange it for tokens:

// Node.js — Token Exchange
const axios = require("axios");

const tokenResponse = await axios.post(
  "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
  new URLSearchParams({
    grant_type: "authorization_code",
    code: authorizationCode,
    redirect_uri: YOUR_REDIRECT_URI,
  }),
  {
    headers: {
      Authorization: `Basic ${Buffer.from(
        `${CLIENT_ID}:${CLIENT_SECRET}`
      ).toString("base64")}`,
      "Content-Type": "application/x-www-form-urlencoded",
    },
  }
);

const { access_token, refresh_token, expires_in } = tokenResponse.data;
// access_token expires in 1 hour (3600s)
// Refresh tokens use rolling renewal and now have a maximum five-year lifetime. Always store the latest refresh token returned by Intuit.

Step 4: Make Authenticated API Calls

Include the access token as a Bearer token in every request:

const response = await axios.get(
  `https://quickbooks.api.intuit.com/v3/company/${realmId}/companyinfo/${realmId}`,
  {
    headers: {
      Authorization: `Bearer ${access_token}`,
      Accept: "application/json",
    },
  }
);

QuickBooks OAuth Token Lifecycle

QuickBooks Online uses short-lived access tokens together with refresh tokens.

Access Token

• Valid for approximately 60 minutes
• Used for authenticated QuickBooks API requests
• Must be renewed when it expires

Refresh Token

Refresh tokens use a rolling renewal model.

Applications should always securely store the latest refresh token returned during renewal.

Intuit has also introduced a maximum five-year lifetime for refresh tokens.

A production integration should therefore:

• Store the newest refresh token after every successful renewal
• Track authorization expiration
• Refresh access tokens before API calls fail
• Provide users with a clear reconnect flow
• Configure the Reconnect URL in the Intuit Developer Portal

If authorization expires completely, the user must reconnect their QuickBooks company through the OAuth authorization flow.

QuickBooks Online API Endpoints for Invoices, Customers, Payments & Bills

Every endpoint follows the pattern: GET|POST /v3/company/{realmId}/{entity}. Here are the most-used endpoints:

QuickBooks Query API, Pagination and Change Data Capture

QuickBooks Online provides different methods for retrieving and synchronizing accounting data.

Query API

The QuickBooks Query API provides SQL-like syntax for retrieving records based on specific conditions.

Example:

SELECT * FROM Invoice WHERE Balance > '0'

Pagination

For larger datasets, use:

• STARTPOSITION
• MAXRESULTS

This prevents the application from attempting to retrieve all available records in a single request.

Change Data Capture

Change Data Capture, or CDC, can retrieve supported records that changed after a specified point in time.

CDC is particularly useful for incremental synchronization.

Recommended Production Sync Flow

Initial full data sync
↓
Pagination
↓
Store records locally
↓
CDC for incremental changes
↓
Webhooks for change notifications

This approach reduces repeated full-data requests and gives the integration better control over synchronization volume.

QuickBooks Online API Rate Limits in 2026

What Happens When the Limit Is Exceeded?

When API limits are exceeded, QuickBooks may return HTTP 429.

Production applications should use:

• Request queuing
• Exponential backoff
• Retry handling
• API request monitoring

Handling 429 (Too Many Requests) Errors

When you hit rate limits, the API returns a 429 status. Implement exponential backoff with jitter:

async function apiCallWithRetry(fn, maxRetries = 5) {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    try {
      return await fn();
    } catch (error) {
      if (error.response?.status === 429 && attempt < maxRetries - 1) {
        const baseDelay = Math.pow(2, attempt) * 1000;
        const jitter = Math.random() * 1000;
        await new Promise((r) => setTimeout(r, baseDelay + jitter));
        continue;
      }
      throw error;
    }
  }
}

Common QuickBooks Online API Error Codes

QuickBooks integrations should handle API errors based on the HTTP status code and the returned fault information.

Production integrations should also log:

• Request ID
• realmId
• Endpoint
• Error response
• Retry status
• Timestamp

This makes production troubleshooting considerably easier.

Common QuickBooks Online API Issues Developers Should Avoid

1. SyncToken Conflicts

2. No Partial Updates

Unlike modern APIs (e.g., PATCH support), the QBO API requires you to send the entire entity object on every update. Missing fields will be set to null.

This is the single most common source of data loss in QBO integrations. (Fix common QuickBooks Online Accounting API errors, 2026)

3. Sparse Updates Misconception

Intuit documents a sparse=true parameter, but it has significant limitations.

It works inconsistently across entity types, and relying on it is risky. Our recommendation: always send the full object.

4. Currency and Locale Issues

Multi-currency companies require extra handling. You must specify CurrencyRef on transactions, and exchange rates are not automatically applied.

If you’re building for international users, plan for this complexity upfront.

5. Sandbox vs. Production Gaps

The sandbox environment doesn’t perfectly mirror production behavior. Certain edge cases (webhooks, specific error codes, rate limiting behavior) may differ.

Always perform thorough testing in production with a test company.

How to Test QuickBooks Online API in Sandbox

Setting Up Your Sandbox

• Log into the Intuit Developer Portal at developer.intuit.com
• Navigate to your app’s Dashboard
• Click “Sandbox” in the left menu — Intuit provides pre-populated sandbox companies with sample data
• Use sandbox credentials (Client ID + Secret from the “Development” keys section)
• Point API calls to: https://sandbox-quickbooks.api.intuit.com/v3/company/{realmId}/

Sandbox Test Data

Sandbox companies come pre-loaded with sample customers, invoices, items, and accounts. You can also:

• Create additional test data via API calls
• Reset sandbox data from the developer portal
• Use the API Explorer in the developer portal for interactive testing

Testing Best Practices

• Write integration tests against sandbox before deploying to production
• Test error handling: intentionally send malformed requests, expired tokens, and duplicate entities
• Verify webhook delivery using tools like ngrok or webhook.site for local development
• Test with multi-currency sandbox companies if your integration handles international clients

QuickBooks Online API Webhooks and CloudEvents

QuickBooks Online webhooks notify your application when data changes, eliminating the need for constant polling.

Available Webhook Events

Webhooks fire on Create, Update, and Delete operations for these entities:

Account, Bill, BillPayment, Budget, Class, CreditMemo, Currency

Customer, Department, Deposit, Employee, Estimate, Invoice

Item, JournalEntry, Payment, Purchase, PurchaseOrder

RefundReceipt, SalesReceipt, TimeActivity, Transfer, Vendor, VendorCredit

Webhook Setup

• In the Intuit Developer Portal, navigate to Webhooks in your app settings
• Enter your endpoint URL (must be HTTPS)
• Select the entities you want to subscribe to
• Intuit generates a verifier token for signature validation

Webhook Payload Format in 2026

QuickBooks Online webhook notifications now use the CloudEvents format.

The previous:

eventNotifications → dataChangeEvent → entities

structure should no longer be used as the primary implementation example.

Important CloudEvents fields include:

Webhook notifications should be treated as change signals.

When your application requires the complete accounting record:

• Receive the webhook event.
• Identify the affected entity.
• Identify the QuickBooks company.
• Retrieve the latest record through the QuickBooks Online API.
• Update the local application data.

Validating Webhook Signatures

Always validate the webhook signature to ensure the payload is from Intuit:

const crypto = require("crypto");

function isValidWebhookSignature(payload, signature, verifierToken) {
  const hash = crypto
    .createHmac("sha256", verifierToken)
    .update(payload)
    .digest("base64");
  return hash === signature;
}

QuickBooks Online API Best Practices for Production Integrations

Error Handling

• Always check the Fault object in error responses for detailed error codes and messages
• Implement retry logic for 429 (rate limit), 500 (server error), and 503 (service unavailable)
• Do not retry 400 (bad request) or 401 (unauthorized) these require code or token fixes
• Log all API errors with full request/response bodies for debugging

Pagination

The QBO query API supports STARTPOSITION and MAXRESULTS:

SELECT * FROM Invoice STARTPOSITION 1 MAXRESULTS 100
SELECT * FROM Invoice STARTPOSITION 101 MAXRESULTS 100

Minor Version Management

• Always specify the minorversion parameter in your API calls: ?minorversion=75
• Pin to a specific version in production don’t use “latest”
• Test new minor versions in sandbox before upgrading production
• Monitor Intuit’s changelog for breaking changes in new minor versions

Idempotency

• The QBO API supports a Request-Id header for idempotent requests
• Use a unique UUID for each create operation to prevent duplicates on retries
• For production-grade systems, real-world validation, duplicate prevention, and error handling are just as important as API connectivity.

Security

QuickBooks Online API Code Examples for Developers

Creating an Invoice (Node.js)

const axios = require("axios");

async function createInvoice(realmId, accessToken) {
  const invoice = {
    Line: [
      {
        Amount: 150.0,
        DetailType: "SalesItemLineDetail",
        SalesItemLineDetail: {
          ItemRef: { value: "1", name: "Services" },
          Qty: 1,
          UnitPrice: 150.0,
        },
      },
    ],
    CustomerRef: { value: "1" },
    BillEmail: { Address: "customer@example.com" },
    DueDate: "2026-04-15",
  };

  const response = await axios.post(
    `https://quickbooks.api.intuit.com/v3/company/${realmId}/invoice?minorversion=75`,
    invoice,
    {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "Content-Type": "application/json",
        Accept: "application/json",
      },
    }
  );

  return response.data.Invoice;
}

Querying Customers (Python)

import requests

def get_active_customers(realm_id, access_token, max_results=100):
    base_url = f"https://quickbooks.api.intuit.com/v3/company/{realm_id}"
    query = f"SELECT * FROM Customer WHERE Active = true MAXRESULTS {max_results}"

    response = requests.get(
        f"{base_url}/query",
        params={"query": query, "minorversion": "75"},
        headers={
            "Authorization": f"Bearer {access_token}",
            "Accept": "application/json",
        },
    )

    response.raise_for_status()
    data = response.json()
    return data.get("QueryResponse", {}).get("Customer", [])


# Usage
customers = get_active_customers(realm_id, access_token)
for customer in customers:
    print(f"{customer['DisplayName']} - {customer['PrimaryEmailAddr']['Address']}")

OAuth 2.0 Token Refresh

async function refreshAccessToken(refreshToken, clientId, clientSecret) {
  const response = await axios.post(
    "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer",
    new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: refreshToken,
    }),
    {
      headers: {
        Authorization: `Basic ${Buffer.from(
          `${clientId}:${clientSecret}`
        ).toString("base64")}`,
        "Content-Type": "application/x-www-form-urlencoded",
      },
    }
  );

  const { access_token, refresh_token, expires_in } = response.data;
  // IMPORTANT: Store the NEW refresh_token — it rotates on each refresh
  // The old refresh_token is invalidated immediately
  return { access_token, refresh_token, expires_in };
}

QuickBooks Online API FAQs

Is the QuickBooks Online API Free in 2026?

QuickBooks API usage depends partly on the type of API call and the developer’s Intuit App Partner Program tier.

Intuit categorizes API usage into:

• Core calls
• CorePlus calls

Core calls include many standard operations, while CorePlus includes many retrieval and reporting operations.

The Builder tier:

• Has no monthly partner-program fee
• Includes a monthly CorePlus API credit allowance

Higher partner tiers provide larger usage allowances and may support additional usage according to Intuit’s current rate card.

Developers building high-volume QuickBooks integrations should review the latest Intuit App Partner Program pricing and API credit policies instead of assuming all API usage is unlimited.

What languages does the QuickBooks API support?

The QuickBooks Online API is language-agnostic since it’s a REST API. Intuit provides official SDKs for Java, .NET, PHP, Node.js, Python, and Ruby. You can also use any HTTP client in any programming language (Go, Rust, Swift, etc.) to interact with the API directly.

How do I get a QuickBooks API key?

QuickBooks doesn’t use traditional API keys. Instead, you register an app at developer.intuit.com to get OAuth 2.0 Client ID and Client Secret credentials. These are used in the OAuth 2.0 authorization flow to obtain access tokens. See our step-by-step guide to setting up an app on the Intuit Developer Portal.

What Are the QuickBooks Online API Rate Limits?

QuickBooks Online Accounting API production guidance allows:

• Up to 500 requests per minute per realmId
• Up to 10 concurrent requests per realmId
• Up to 40 batch requests per minute per realmId
• Up to 30 operations in one batch request

If a limit is exceeded, the API may return HTTP 429.

Production integrations should implement request queuing, retry handling, and exponential backoff.

Can I use the QuickBooks API with Desktop?

The QuickBooks Online API does not work with QuickBooks Desktop. Desktop uses a separate integration method via the QuickBooks Web Connector (QBWC) or the QuickBooks Desktop SDK, which uses XML-based messaging (qbXML). If you need to support both, you’ll need to build two separate integrations. Consider migrating Desktop clients to QuickBooks Online for API access.

How Do I Handle QuickBooks OAuth 2.0 Token Expiration?

QuickBooks access tokens are valid for approximately one hour.

When the access token expires:

• Use the refresh token to request a new access token.
• Save the latest refresh token returned by Intuit.
• Update the token expiration information.
• Retry the API request if required.

Refresh tokens now also have a maximum lifetime.

Applications should therefore provide users with a reconnection path rather than assuming an actively refreshed QuickBooks authorization will remain valid indefinitely.

Can the QuickBooks Online API Access Bank Feed Transactions?

The QuickBooks Online Accounting API can access supported accounting transactions after they are recorded in QuickBooks.

However, developers should not assume that raw bank-feed activity waiting in the “For Review” area is available through the standard Accounting API in the same way as posted accounting transactions.

If an application requires direct access to raw bank-account transaction feeds, it may need a separate banking-data integration in addition to the QuickBooks Online API.

Need Help Building Your QuickBooks Integration?

Contact us