← Back to Blogs
by

How to Call the QuickBooks Online API: A Practical Guide

QuickBooks Online is the accounting system behind countless small and mid-sized businesses. If you sell through Shopify, a POS or a marketplace, you will almost certainly be asked to push sales, customers, payments or inventory-related journals into QuickBooks. The way to do that is the QuickBooks Online Accounting API.

This guide covers the full path: creating an app, authenticating with OAuth 2.0, and making your first calls.

How the API works

The QuickBooks Online API is a REST API that exchanges JSON. Every call targets one specific QuickBooks company, identified by a realmId (also called the company ID), and every call needs a valid OAuth 2.0 access token.

There are two environments:

  • Sandbox: https://sandbox-quickbooks.api.intuit.com for development and testing with fake company data.
  • Production: https://quickbooks.api.intuit.com for real customer companies.

Resource URLs follow this pattern:

https://quickbooks.api.intuit.com/v3/company/{realmId}/{resource}?minorversion=75

Step 1: Create an app on the Intuit Developer portal

  1. Sign in to the Intuit Developer portal and create an app.
  2. Choose the QuickBooks Online Accounting scope.
  3. Copy your Client ID and Client Secret for the development (sandbox) keys.
  4. Register one or more Redirect URIs. The address you use in the authorization request must match exactly.

Production keys are issued after you complete Intuit's app assessment, so start that early if you are building for real customers.

Step 2: Authenticate with OAuth 2.0

QuickBooks uses the OAuth 2.0 authorization code flow. The business owner must approve your app once, and you then receive tokens to act on their behalf.

2a. Send the user to the consent page

https://appcenter.intuit.com/connect/oauth2
  ?client_id=<CLIENT_ID>
  &response_type=code
  &scope=com.intuit.quickbooks.accounting
  &redirect_uri=<REDIRECT_URI>
  &state=<RANDOM_STRING>

After the user approves, Intuit redirects back to your redirect URI with a code, the realmId of the company, and your state value. Check that state matches what you sent, then save the realmId.

2b. Exchange the code for tokens

POST https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer
Authorization: Basic base64(CLIENT_ID:CLIENT_SECRET)
Content-Type: application/x-www-form-urlencoded
Accept: application/json

grant_type=authorization_code
&code=<CODE>
&redirect_uri=<REDIRECT_URI>

The response contains an access token and a refresh token.

Step 3: Make your first API call

Send the access token as a Bearer token. For example, to read company information:

GET https://sandbox-quickbooks.api.intuit.com/v3/company/{realmId}/companyinfo/{realmId}?minorversion=75
Authorization: Bearer <ACCESS_TOKEN>
Accept: application/json

Querying data

QuickBooks has a SQL-like query language. Send the query to the /query endpoint:

GET /v3/company/{realmId}/query?query=select * from Customer where DisplayName = 'ABC Store'&minorversion=75

Use STARTPOSITION and MAXRESULTS in the query to page through large result sets.

Creating a record

To create an invoice, POST JSON to the resource endpoint:

POST /v3/company/{realmId}/invoice?minorversion=75
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json
Accept: application/json

{
  "CustomerRef": { "value": "58" },
  "Line": [
    {
      "Amount": 100.00,
      "DetailType": "SalesItemLineDetail",
      "SalesItemLineDetail": { "ItemRef": { "value": "1" } }
    }
  ]
}

Use the Intuit API reference to confirm the required fields for each resource, because they differ by transaction type and by country and tax settings.

Updating a record

QuickBooks uses a SyncToken for optimistic locking. To update an existing record, read it first and send back its Id and current SyncToken with your changes. If someone else changed the record in the meantime, your update is rejected, which prevents silent overwrites.

Step 4: Keep your tokens alive

Token handling is where most QuickBooks integrations break.

  • Access tokens last about one hour. Refresh them proactively before they expire instead of waiting for a 401 error.
  • Refresh tokens rotate. Each refresh can return a new refresh token. Always save the newest one, and never keep using the old one.
  • Refresh tokens still expire. Intuit has changed its refresh token policy in the past, including in late 2025, so check the current lifetime in Intuit's documentation and build a re-authorization flow for when a connection eventually lapses.
  • Avoid refresh races. If several workers refresh the same connection at once, one of them can invalidate the others. Use a lock around the refresh.

To refresh, call the same token endpoint with the refresh token:

POST https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer
Authorization: Basic base64(CLIENT_ID:CLIENT_SECRET)
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&refresh_token=<REFRESH_TOKEN>

Step 5: React to changes with webhooks

Instead of repeatedly asking QuickBooks what changed, subscribe to webhooks for the entities you care about, such as invoices, customers and payments. QuickBooks sends a notification when records change, and you then fetch the details through the API. For gap recovery, the Change Data Capture (CDC) endpoint lets you pull everything that changed since a given time.

Common mistakes to avoid

  • Always send minorversion. It controls which version of the data model you get, and older minor versions have been retired over time. Use a current one such as 75 or later.
  • Do not mix sandbox and production. Keys, tokens, base URLs and company IDs are separate for each.
  • Respect rate limits. QuickBooks throttles requests per company, so queue calls, batch where possible and back off on 429 responses.
  • Store the realmId with the tokens. One connection equals one company.
  • Log request IDs. Intuit returns an intuit_tid header that its support team will ask for when you report a problem.

Using QuickBooks with AllSync

You can build all of this yourself, but token refresh, retries, mapping and monitoring add up quickly. With AllSync, you authorize QuickBooks once and then connect it to the rest of your systems. For example, Shopify orders and refunds can arrive by webhook, be mapped and posted to QuickBooks as invoices, sales receipts or credit memos, and an offline connector can bring in data from local POS or ERP databases that have no public API.

Conclusion

Calling the QuickBooks Online API comes down to five things: create an app, authorize through OAuth 2.0, call the /v3/company/{realmId} endpoints with a Bearer token, manage token refresh carefully, and use webhooks to stay in sync. Get the token handling right and the rest is straightforward.

Want to connect QuickBooks Online with your sales channels? Talk to us about doing it with AllSync.

← Previous PostNext Post →