QuickBooks
Connect QuickBooks to manage customers, vendors, invoices, bills, payments, the chart of accounts, and reports.
You paste your Intuit app's OAuth 2.0 Client ID and Client Secret into PopMCP, plus the word "sandbox" in Environment if you are connecting an Intuit sandbox company instead of a live one.
App review before this connector works
Intuit blocks an app's QuickBooks Online production keys until you complete the app assessment questionnaire in the developer portal and Intuit reviews the answers.
- Typical wait
- Intuit publishes no review SLA. Developers commonly report anything from a few business days to about two weeks, and any follow-up question from the reviewer restarts the clock.
- Cost
- Free
- Blocked until approved
- Production OAuth client ID and secret stay hidden, so you cannot connect a real QuickBooks Online company. Everything you build against sandbox authenticates only against fake sandbox companies - no live customer, invoice, payment or ledger data until the keys are unblocked.
- Works meanwhile
- Create the app and use development keys against a sandbox company immediately: full OAuth 2.0 flow, all Accounting API endpoints, webhooks and the API Explorer work on day one.
Where to apply: developer.intuit.com, open your app, go to Keys and credentials, switch the environment toggle to Production, fill in App details, then the Compliance tab and click Start questionnaire.
- Answering No to whether you tested the app in sandbox is an automatic rejection.
- The app must be plausibly related to accounting, payments, finance or QuickBooks workflows; generic data-warehouse or scraping use cases get pushed back.
- You need real, reachable URLs - host URL, launch URL, disconnect URL, EULA and privacy policy - before the questionnaire will submit.
- The questionnaire asks for concrete security answers (token storage, encryption, access control); vague answers cause a second round of questions.
- Internal or in-house-only integrations with no public app still have to complete the questionnaire.
- Listing on the QuickBooks App Store is a separate, longer technical review - it is not needed just to get production keys.
- Intuit does not state a turnaround anywhere in its docs - do not plan a launch date around a promised review time.
- Setup time
- 15 min for sandbox. Production keys wait on Intuit's app assessment review.
- Auth
- OAuth authorization
- API base URL
- https://quickbooks.api.intuit.com/v3/company/{realmId} (sandbox: https://sandbox-quickbooks.api.intuit.com/v3/company/{realmId})
- Rate limits
- 500 requests per minute per company (realmId) with at most 10 concurrent requests. The batch endpoint is throttled separately and more tightly. Over the limit returns 429 with a Retry-After header.
Before you begin
- Free Intuit Developer account at developer.intuit.com
- A QuickBooks Online company you administer. A free sandbox company is created for your developer account automatically.
- For live company data you must submit Intuit's app assessment questionnaire and wait for review before production keys unlock
- Sandbox keys work immediately and only against Intuit sandbox companies
Get your credentials
Create an app in the Intuit Developer portal
Sign in at developer.intuit.com and open My Hub, then Workspaces. Click Create an app, choose QuickBooks Online and Payments, name it, and tick the com.intuit.quickbooks.accounting scope.
Workspaces
Apps and sandboxes owned by your developer account.
| App name | Platform | Status | Created |
|---|---|---|---|
| Acme Books SyncQuickBooks Online and Payments | Accounting | Development | Mar 4, 2026 |
com.intuit.quickbooks.accounting is the only scope PopMCP needs.
Add PopMCP's callback URL as a Redirect URI
Open the app and click Settings in the left menu, then open the Redirect URIs tab with Development selected. Click Add URI, paste the callback URL PopMCP shows on the connect form, and click Save.
Settings
Redirect URIs and app details for this app.
Development and Production keep separate redirect URI lists.
Copy the development Client ID and Client Secret
Click Keys & credentials in the left menu with Development selected, toggle Show credentials, and copy Client ID and Client Secret. Type sandbox in PopMCP's Environment field when you use these keys.
Keys & credentials
OAuth 2.0 keys for this app.
- Client ID
- ABxYd****Kq7L
- Client Secret
- 9fT2****c40e
- Environment
- Sandbox
Unlock production keys
Switch to the Production tab and complete App details, covering host domain, launch URL and disconnect URL. Click Start Questionnaire, answer every section, submit it, and wait for Intuit's review.
Keys & credentials
Finish these before production keys are issued.
| Section | Status |
|---|---|
| General Questions | Complete |
| App Information | Complete |
| Authorization & Authentication | In progress |
| API Usage | Not started |
| Accounting API | Not started |
| Error Handling | Not started |
| Security | Not started |
Copy the production keys once approved
After approval, copy Client ID and Client Secret from the Production tab on Keys & credentials. Open Settings, then Redirect URIs, switch to Production, add the same PopMCP callback URL and click Save.
Paste into PopMCP and pick the company
Enter the Client ID and Client Secret, leave Environment blank for a live company, and click connect. Sign in on Intuit's page and choose the QuickBooks company to authorize.
Connect in PopMCP
Open your workspace, choose QuickBooks in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Auth typepreset | Create an app at developer.intuit.com (Accounting scope). The OAuth flow keeps your QuickBooks login on Intuit's side. |
| Client IDtext | Your app's "Client ID" from the Keys & OAuth tab on developer.intuit.com. |
| Client secretsecret | Your app's "Client Secret". Stored encrypted; used server-side only and never shown again.Encrypted with AES-256-GCM on save and never shown again. |
| Environmenttext | Leave blank for a live company (Production). Enter "sandbox" only if you're connecting an Intuit sandbox/development company using your app's Development keys. |
https://app.popmcp.com/api/providers/quickbooks/callbackAdd this exact URL to your Intuit app's "Redirect URIs" (under Keys & OAuth, for the environment whose keys you're using). It must match exactly, or Intuit rejects the authorization.
PopMCP verifies the credential against QuickBooks immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to QuickBooks at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| com.intuit.quickbooks.accounting | The only scope PopMCP needs. It covers customers, vendors, invoices, bills, payments, the chart of accounts and reports. |
Verify it worked
PopMCP shows the QuickBooks connection as Connected with the company name Intuit returned. A company-info or chart-of-accounts call returns your real accounts.
Troubleshooting
invalid_redirect_uri on the Intuit consent screen
Why: The callback URL is missing from this environment's Redirect URIs, or differs by a character such as a trailing slash or http instead of https.
Fix: Paste PopMCP's callback URL into the Redirect URIs tab on the app's Settings page under the matching Development or Production tab, then Save.
401 Unauthorized on every API call
Why: Development keys used against a live company, or production keys against a sandbox company.
Fix: Match the keys to the Environment field. Leave it blank for production, type sandbox for development keys.
Production keys are greyed out
Why: The app assessment questionnaire has not been submitted or approved.
Fix: Complete App details and submit the questionnaire under the Production tab, then wait for Intuit's review.
429 Too Many Requests
Why: Over 500 calls in a minute for that company, or more than 10 concurrent calls.
Fix: Back off and honour the Retry-After header. The batch endpoint carries its own lower limit, so spread batch calls out too.