QuickBooks Authentication

name: QuickBooks API authentication
generated: '2026-11-05'
method: searched
source: https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0
docs: https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0
sources:
- https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0
- https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/openid-connect
- https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-openid-discovery-doc
- https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/faq
- https://developer.api.intuit.com/.well-known/openid_configuration
- https://developer.api.intuit.com/.well-known/openid_sandbox_configuration
- openapi/quickbooks-online-accounting-openapi-generated.yml
- openapi/quickbooks-payments-openapi-generated.yml
derived_from: derive-authentication.py over the generated contracts, upgraded with the OAuth 2.0 and discovery-document pages
summary:
  types: [oauth2, openIdConnect]
  oauth2_flows: [authorizationCode]
  discovery_documents:
    production: https://developer.api.intuit.com/.well-known/openid_configuration
    sandbox: https://developer.api.intuit.com/.well-known/openid_sandbox_configuration
  local_copies:
  - well-known/developer.api.intuit.com-openid_configuration.json
  - well-known/developer.api.intuit.com-openid_sandbox_configuration.json
schemes:
- name: oauth2
  type: oauth2
  description: >-
    Intuit OAuth 2.0 authorization code flow. The app redirects the user to the authorization endpoint
    with client_id, redirect_uri, response_type=code, scope and state; Intuit redirects back with a code
    and the realmId of the company the user chose; the app exchanges the code at the token endpoint using
    HTTP Basic authentication (client_id:client_secret, base64) and receives a bearer access token.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://appcenter.intuit.com/connect/oauth2
    tokenUrl: https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer
    refreshUrl: https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer
    revocationUrl: https://developer.api.intuit.com/v2/oauth2/tokens/revoke
    scopes: 20
    scopes_file: scopes/quickbooks-scopes.yml
  token_endpoint_auth: HTTP Basic (client_id:client_secret) per token_endpoint_auth_methods_supported in the discovery document
  request_header: 'Authorization: Bearer <access_token>'
  access_token_lifetime: Access tokens are valid for 60 minutes (3,600 seconds). When they expire, use refresh tokens to refresh them.
  refresh_token_lifetime: x_refresh_token_expires_in 8640000 seconds (100 days) in the documented token response; x_refresh_token_hard_expires_in 157680000 seconds when the request carries the header x-include-refresh-token-hard-expires-in true. If a refresh token expires, users need to go through the authorization flow again.
  pkce: not documented
  client_credentials: not offered
  sources:
  - openapi/quickbooks-online-accounting-openapi-generated.yml
  - openapi/quickbooks-payments-openapi-generated.yml
  - https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://developer.api.intuit.com/.well-known/openid_configuration
  description: >-
    OpenID Connect layered on the same authorization code flow with the openid scope (plus profile,
    email, phone, address). The discovery document names issuer https://oauth.platform.intuit.com/op/v1,
    userinfo https://accounts.intuit.com/v1/openid_connect/userinfo, jwks https://oauth.platform.intuit.com/op/v1/jwks,
    response_types_supported code, and RS256 id_token signing.
  issuer: https://oauth.platform.intuit.com/op/v1
  userinfo_endpoint: https://accounts.intuit.com/v1/openid_connect/userinfo
  jwks_uri: https://oauth.platform.intuit.com/op/v1/jwks
  sources:
  - https://developer.api.intuit.com/.well-known/openid_configuration
  - https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/openid-connect
environments:
  sandbox:
    discovery: https://developer.api.intuit.com/.well-known/openid_sandbox_configuration
    api_bases: [https://sandbox-quickbooks.api.intuit.com, https://sandbox.api.intuit.com]
    note: Sandbox accepts http://localhost redirect URIs; production requires a public HTTPS callback.
  production:
    discovery: https://developer.api.intuit.com/.well-known/openid_configuration
    api_bases: [https://quickbooks.api.intuit.com, https://api.intuit.com]
tools:
- name: OAuth 2.0 Playground
  url: https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0-playground
- name: OAuth client libraries
  url: https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/example-sdk-oauth-2.0-integrations