How to Create OAuth Credentials for Exact Online UK

This guide will help you set up your Exact Online OAuth app for the UK Exact Online instance and add its credentials to Apideck.

Before you begin, you'll need:

• An Exact Online account on the UK instance (start.exactonline.co.uk). This connector is pinned to the United Kingdom, so the app you register must belong to the UK instance.
• An Exact Online developer subscription for the UK region if your app will connect consumers outside your own Exact Online instance: it is what lets you register and manage an app that links multiple customers to it, and in the UK it is free. An API key registered from an ordinary Exact Online subscription (Company name > Import/Export > App registrations) only reads that company's own data, so it cannot connect your customers' companies. An app that only ever connects your own UK instance does not need a developer subscription, and a UK subscription does not cover another country's instance.
• A user in that instance that is allowed to authorize third-party app connections. The account you register the app with also needs Exact's Manage apps right.

Which connector am I configuring? exact-online-uk has a fixed UK host and no region setting, and an app registered on the UK instance cannot connect consumers on the Dutch, Belgian, German or any other Exact Online instance. If your consumers span several countries, use the exact-online connector, which lets each consumer pick their country with the Select your API domain connection setting, or exact-online-nl for a Netherlands-pinned integration.

App Store listings in the UK. Since 2 September 2026 the Exact App Store storefront is no longer available in the UK, so apps can no longer be published or listed there. App registration, scopes and Exact's review work as before, and existing approvals stay valid.

How to get a test environment. Your developer subscription is itself a live environment with its own divisions, and Exact offers a 30-day free trial of Exact Online for the UK (no credit card, example data preloaded) as the closest thing to a sandbox. You register your own app for this connector from the start, so your brand is on the consent screen from your very first test connection.

1. Create the OAuth application

Sign in with your developer account

• Sign in to Exact Online UK with the account that holds the developer subscription, then go to Partners > App Store > Manage my apps. Exact's Register your app article walks through the registration.

Register a test app

• Click Register a test app (you can move it to production later)

  

Configure app details

• Enter the following details:

  • App Name: Choose a descriptive name for your app
  • Redirect URI: https://unify.apideck.com/vault/callback
  • Accept the terms and conditions

  

The redirect URI must be exactly https://unify.apideck.com/vault/callback. Exact rejects localhost and any non-HTTPS redirect URI, and a mismatch fails authorization. Do not add a vendor or local development URL here: Apideck handles the callback for every connection.

Get your OAuth credentials

• After creating the app, note down the Client ID and Client Secret

  

💡 TIP: Copy the Client ID and Client Secret immediately. The Client Secret may only be visible once when you first create the app.

2. Add the credentials in Apideck

• Open the Exact Online UK connector configuration in the Apideck Dashboard

• Select Use your Exact Online client credentials

• Enter the following OAuth credentials:

  • Client ID → client_id: Paste the Client ID from your Exact Online app
  • Client Secret → client_secret: Paste the Client Secret from your Exact Online app

• Click Save settings to save your credentials

  

Exact Online uses the same app credentials for testing and production, so keep testing on the UK instance (credentials, tokens and division ids issued on the UK host are not portable to another country's host), and be careful when testing against production data.

3. Set your app's scopes

Exact Online controls access through the scopes on your app registration, not through the consent screen, so there is nothing to set in Apideck and nothing for your consumers to choose.

Set the scopes in Partners > App Store > Manage my apps > [your app] > Submit for review > Data & security review. This is the same Submit for review flow described in section 4, so set the scopes there and submit once. A new scope is usable once Exact has processed the review, and changing scopes does not reset an existing approval.

Grant access to every area your integration uses. In particular, payments and bill payments are read from Exact's cash-flow area, and invoice balances are calculated from it. Without cash-flow access, payment and bill-payment calls fail with a 403 and invoice balance comes back null — the amount still open cannot be determined without it — so grant the app access to Exact's cash-flow area (the financial.cashflow scope).

The app-permissions screen in a connected company's Exact Online Security centre is read-only; scopes can only be changed on your app registration.

What a connection can reach is also bounded by the authorizing user's own Exact Online rights and by the division (administration) the connection resolves. Apideck fills the division id in automatically after authorization; your consumers never type it, and multiple companies are addressed with the x-apideck-company-id header.

4. Get your app reviewed before onboarding customers outside your own instance

A freshly registered app works immediately for consumers in the same Exact Online instance that created it, which is everything you need to build and test end to end. To connect customers on other Exact Online tenants, submit it for review (Submit for review) from your app registration; once it passes, it can serve consumers across the UK instance. Ask your Exact contact for an expected timeline so you can sequence your pilot customers around it.

Publishing on the Exact App Store is no longer possible in the UK, and it was never needed for a private integration: an approved app can serve external customers without being published.

5. Design notes before you go live

• Token handling is Apideck's job. Access tokens last 10 minutes and Apideck refreshes them automatically. You do not store or rotate anything.
• Refresh tokens are single-use and go stale after 30 days of inactivity. Each refresh invalidates the previous token, and a connection that goes unused for 30 days needs the consumer to authorize again. If your product has seasonal or low-frequency users, plan a re-authorization prompt for them.
• Bills are read-only on this connector. Your integration can read purchase invoices from Exact Online UK but not create, update or delete them, so set that expectation with customers who expect to push bills. Check the connector's Supported Resources tab for the per-resource write coverage before you scope a feature.
• Payments need a bank journal code. Creating payments or bill payments requires a valid bank journal code (the bank_journal_code connection setting), otherwise Exact returns an "Invalid journal" error. Decide whether you set it per connection during onboarding or expose it to your consumers.
• Financial report classifications default to Dutch RGS headings. On a UK administration, set the Balance Sheet and Profit & Loss classification-title connection settings during onboarding; left untouched, report sections fall back to coarser groupings.
• The UK instance caps REST messages at 9.5 MB. The larger 38 MB ceiling applies only to the Netherlands and Belgium, worth knowing if you push large attachments.
• Call budgets are per app, per company. The per-minute and per-day limits are listed on the connector's Overview and on Exact's API limits page. Build your sync to back off on errors rather than retrying tightly.

6. Test your connection

Now that your Exact Online UK connector is configured, test the connection:

1. Open Test Vault from the connector configuration
2. Click Authorize to authorize the connection. There is no region to pick: this connector always uses the UK instance.

3. You will be redirected to the Exact Online (United Kingdom) domain to sign in
4. Once authorized, the connection status changes to Connected

FAQ and troubleshooting

Authorization fails with an invalid redirect or a 401. The redirect URI in your Exact app registration must be character-for-character https://unify.apideck.com/vault/callback. Exact rejects localhost and non-HTTPS values outright.

A consumer outside the UK cannot authorize. App registrations are per country instance, and this connector is pinned to the UK one. Serve those consumers through the exact-online connector with a separate app registered on their country's Exact Online instance, or through exact-online-nl for the Netherlands.

A consumer on another UK Exact Online tenant cannot connect. Until the app passes Exact's internal review it is limited to the instance that created it. Submit it for review from your app registration, and onboard those customers once it passes.

Payments or bill payments fail with 403 "AppScopeViolated ... Cannot read 'financial.cashflow' scope", but other resources work. Your app registration lacks cash-flow access. Add it under Submit for review > Data & security review and resubmit. The connection itself shows as Connected while payment calls fail, and invoices still list — but their balance is null, because it is derived from the same cash-flow area. Once Exact has processed the review, retry the call; if it still returns the same error, have the consumer re-authorize the connection once so it picks up the new scope.

A connection that used to work now asks for authorization again. The refresh token expired after 30 days without use, or the consumer revoked access in Exact Online. The consumer needs to re-authorize; nothing in your Apideck configuration changes.

Calls start returning 429. You are over Exact's call budget for that app and company. Serialize the requests and add backoff. If a consumer legitimately needs a higher ceiling, that is a conversation about their Exact Online plan.

Still stuck? Reach out to Apideck Support.