Connect QuickBooks Online

1. Why you create your own app

WeaveKit reads your QuickBooks Online company through an Intuit app that you own, not a shared WeaveKit app. That means your client id, client secret, and refresh token stay under your control, and you can revoke them from Intuit at any time without depending on us.

WeaveKit only reads data through this connection — customers, invoices, payments, credit memos, items, recurring transaction templates, and company information (including your home currency and other preferences). It never writes to your books.

WeaveKit's own code only reads, never writes. Intuit's accounting scope itself grants full accounting access, since Intuit offers no read-only variant of that scope — the restriction is enforced by our code, not by the grant.

2. Create the Intuit app

1. Go to developer.intuit.com and sign in or create a developer account.
2. Create a new app and choose QuickBooks Online and Payments.
3. When asked which scopes to request, choose only Accounting.
4. Name the app whatever you like — the name is not shown to WeaveKit.

3. App details Intuit will ask for

Intuit's app setup asks for a handful of URLs and details. Use these values:

The redirect URI is the one value that has to match exactly, character for character, including the https:// and with no trailing slash. Intuit keeps a separate redirect URI list for each key pair, so add it in both places: under your development keys and, once you have them, under your production keys. A missing or mistyped entry is what produces Intuit's "invalid redirect_uri" error when you press Connect.

4. Complete the app assessment

Intuit requires every app that will touch a live company to pass an app assessment questionnaire before it issues production keys. Until that's approved, your app only has development keys, which work against a sandbox company, not your real one.

When the questionnaire asks for a link to the instructions that told you to create the app, use this page's URL: https://weavekit.ai/docs/quickbooks/.

5. Connect it in WeaveKit

In WeaveKit, go to Settings → Integrations and press Connect QuickBooks (or Add company, if you already have one connected). Enter three things:

• Client id — from your app's Keys & credentials page.
• Client secret — from the same page, the same key pair.
• Environment — sandbox or production, matching the key pair you copied.

Then choose one of two buttons:

• Save keys stores the pair for your whole workspace and connects nothing. Use this when the person holding the Intuit keys is not the person who will pick the company — they save once, and whoever connects later has nothing to type.
• Connect with QuickBooks goes straight to Intuit using the pair you just typed, and stores nothing of its own.

When you press Connect with QuickBooks, Intuit's own consent screen opens, signed in as you; choose the company you want WeaveKit to read and authorize it. Intuit sends you back to WeaveKit, which records the company and starts the first sync within a few minutes. You never have to find a realm id or mint a token by hand — Intuit reports the company on the way back.

Once the keys are saved, this dialog gets much shorter for everyone in your workspace. It shows one line — "App keys on file for Production, client ID ending ····1234" — with Replace and Remove beside it, and a single Connect with QuickBooks button. Saved keys are kept per environment, so sandbox and production each have their own pair. Connecting a second company needs nothing typed either.

If the connection ever needs re-authorizing, press Reconnect on that company's row. It reuses the keys already stored, so there is nothing to paste again.

6. If you already have a refresh token

The Connect button above is the normal path and nothing here is required. But if you already hold a refresh token minted by hand — or you would rather not use the consent screen — open I already have a refresh token inside the same form and supply the realm id and refresh token as well as the client id and secret. This path always asks for the client id and secret, even when a saved pair is on file, because the token you paste was minted against a specific app.

To mint one, use Intuit's OAuth 2.0 Playground:

1. Open the OAuth 2.0 Playground from the Intuit developer portal, with your app selected.
2. Choose the environment that matches the keys you're using (sandbox or production), and the com.intuit.quickbooks.accounting scope.
3. Authorize and select your company.
4. Copy the realm id the Playground shows for your company, and the refresh token after exchanging the authorization code.

A hand-minted refresh token is single-use: WeaveKit exchanges it immediately when you save and rotates it automatically after that. If a save fails, mint a fresh one before trying again — the one you pasted is already spent.

7. Disconnecting

You can disconnect from either side:

• From WeaveKit: Settings → Integrations → QuickBooks → Disconnect. This immediately deletes that company's stored keys and stops all reads; any data already synced is kept ("Disconnected — data kept"). Pressing Remove afterward deletes that synced data and the connection itself. Neither press deletes your saved app keys — those belong to the workspace, and only the Remove beside the saved-keys line in the connect dialog deletes them.
• From Intuit: My Apps → revoke the connection. This stops all reads, but takes effect at the next token refresh rather than immediately.

Disconnecting in WeaveKit does not revoke the grant inside Intuit — revoke it there separately if you want it gone there too.

8. Security summary

• Your keys are stored in an encrypted vault.
• All data is transmitted over TLS.
• Data is primarily processed in the United States; see the privacy policy for details.
• Never sold, and never used to train WeaveKit models. It is processed by our hosting and AI providers only to run your agents — see the privacy policy.

Questions about this integration: me@alejandroroman.dev.