# Exact Online — Accounting API: configuration

> Canonical URL: https://developers.apideck.com/apis/accounting/exact-online/configuration

# How to Create OAuth Credentials for Exact Online

This guide will help you set up your Exact Online OAuth app and add its credentials to Apideck.

**Before you begin, you'll need:**

- An Exact Online account in the **country instance your consumers use**. Exact Online runs separate country instances (NL, BE, DE, ES, UK, US) with their own hosts and their own App Center, and **an app registered in one country cannot connect consumers in another**, so register one app per country you serve.
- An **Exact Online developer subscription** for that country if your app will connect consumers outside your own Exact Online instance. It is what lets you register and manage an app that links multiple customers to it. In the **UK, US, Spain and France** it is free; in the **Netherlands and Belgium** Exact charges **EUR 15 per month excluding VAT per country** (confirm the current figure, and the figure for Germany, before you budget). Exact's [Sign up for a developer's subscription](https://support.exactonline.com/community/s/article/All-All-DNO-Content-developerssubscriptiont?language=en_GB) article links to the sign-up page for each country. An API key registered from an ordinary Exact Online subscription only reads that company's own data, so it cannot connect your customers' companies; an app that only ever connects your *own* Exact Online instance does not need a developer subscription.
- A user in that instance that is allowed to authorize third-party app connections.

> **Which connector am I configuring?** On `exact-online` the consumer picks their country with the **Select your API domain** connection setting (Belgium, Germany, Netherlands, Spain, United Kingdom, United States). If every consumer of your integration sits in one country, the region-pinned siblings `exact-online-nl` and `exact-online-uk` have a fixed host and no region picker.

> **App Store listings in the UK, US, Spain and France.** Since 2 September 2026 the Exact App Store storefront is no longer available in these countries, so apps can no longer be published or listed there. App registration, scopes and Exact's review work as before, and existing approvals stay valid. The Netherlands, Belgium and Germany keep the App Store.

## 1. Create the OAuth application

### Sign in with your developer account

- **Netherlands, Belgium, Germany:** sign in to the [Exact Online App Center](https://apps.exactonline.com/) and make sure you are in the country instance you want to register the app for.
- **UK, US, Spain, France:** sign in to Exact Online in that country with the account that holds the developer subscription, then go to **Partners > App Store > Manage my apps**. The App Center storefront link redirects in these countries. If you don't see a **Partners** menu, the account has no developer subscription.

Exact's [Register your app](https://support.exactonline.com/community/s/article/All-All-DNO-Process-appcenter-eol-appcenter-dev-registerapp-p) article walks through the registration.

  ![Sign in](https://res.cloudinary.com/apideck/image/upload/v1755863845/docs/connectors/exact-online/login-exact.png)

### Register a test app

- Click **Register a test app** (you can move it to production later)

  ![Register app](https://res.cloudinary.com/apideck/image/upload/v1755863845/docs/connectors/exact-online/app-page.png)

Exact advises keeping the number of app registrations to a maximum of four (for example one per DTAP stage: development, test, acceptance, production). Plan your registrations before you create them.

### Configure app details

- Enter the following details:
  - **App Name:** Choose a descriptive name for your app
  - **Redirect URI:** `https://unify.apideck.com/vault/callback`
  - Accept the terms and conditions

  ![App details](https://res.cloudinary.com/apideck/image/upload/v1755863845/docs/connectors/exact-online/register-app.png)

> **The redirect URI must be exactly `https://unify.apideck.com/vault/callback`.** Exact rejects `localhost` and any non-HTTPS redirect URI, and a mismatch fails the authorization with an HTTP 401. Do not add a vendor or local development URL here: Apideck handles the callback for every connection.

### Get your OAuth credentials

- After creating the app, note down the **Client ID** and **Client Secret**

  ![Client ID & Secret](https://res.cloudinary.com/apideck/image/upload/v1755863845/docs/connectors/exact-online/clientid-secret.png)

**💡 TIP**: Copy the Client ID and Client Secret immediately. The Client Secret may only be visible once when you first create the app.

## 2. Add the credentials in Apideck

- Open the [Exact Online connector configuration](https://platform.apideck.com/configuration/accounting/exact-online) in the **Apideck Dashboard**
- Select **Use your Exact Online client credentials**
- Enter the following OAuth credentials:
  - **Client ID** → `client_id`: Paste the Client ID from your Exact Online app
  - **Client Secret** → `client_secret`: Paste the Client Secret from your Exact Online app
- Click **Save settings** to save your credentials

 ![dashboard setup](https://res.cloudinary.com/apideck/image/upload/v1762523266/docs/connectors/exact-online/test-vault.png)

Apideck does not ship shared test credentials for this connector, so your own app credentials are what every connection uses. Because Exact Online uses the same credentials for testing and production, register and test in the same country instance your consumers are in, and be careful when testing against production data.

## 3. Set your app's scopes

Exact Online controls access through the scopes on your app registration, not through the consent screen, so there is nothing to set in Apideck and nothing for your consumers to choose.

Set the scopes in your app registration under **Submit for review > Data & security review** (in the UK, US, Spain and France, reach your app through **Partners > App Store > Manage my apps**; there is no direct link to the review). This is the same **Submit for review** flow described in section 4, so set the scopes there and submit once. Exact usually processes a review within 5 working days; if it takes longer, contact Exact support. A new scope is usable once the review is approved, and changing scopes does not reset an existing approval.

Grant access to every area your integration uses. In particular, payments and bill payments are read from Exact's cash-flow area, and invoice balances are calculated from it. Without cash-flow access, payment and bill-payment calls fail with a 403 and invoice `balance` comes back `null` — the amount still open cannot be determined without it — so grant the app access to Exact's cash-flow area (the `financial.cashflow` scope).

The app-permissions screen in a connected company's Exact Online **Security centre** is read-only; scopes can only be changed on your app registration.

What a connection can reach is also bounded by the authorizing user's own Exact Online rights and by the division (administration) the connection resolves. Apideck fills the division id in automatically after authorization; your consumers never type it, and multiple companies are addressed with the `x-apideck-company-id` header.

## 4. Get your app reviewed before onboarding customers outside your own instance

A freshly registered app works immediately for consumers **in the same Exact Online instance that created it**, which is everything you need to build and test end to end. To connect customers on other Exact Online tenants, submit the app for Exact's review (**Submit for review** on your app registration); once it passes, it can serve consumers across that country instance. Exact usually completes a review within 5 working days, so sequence your pilot customers around that.

Publishing the app on the Exact Online App Store is a separate, optional step with its own review process, and is no longer possible in the UK, US, Spain and France. **An approved app can serve external customers without being published**, so App Store publication is not on the critical path for a private integration.

## 5. Design notes before you go live

- **Token handling is Apideck's job.** Access tokens last 10 minutes and Apideck refreshes them automatically. You do not store or rotate anything.
- **Apideck renews refresh tokens in the background, so unused connections stay connected.** Exact's refresh tokens are single-use and expire after 30 days of inactivity, and Apideck renews them before then, so a connection does not lapse merely from going unused, including for seasonal or low-frequency users. The consumer needs to authorize again if access is revoked in Exact Online, the authorizing user loses access, or a renewal fails.
- **Never issue Exact Online calls in parallel.** Exact requires sequential requests and explicitly disallows multi-threaded calling, and it will not mint a new access token more often than once every 570 seconds. Build your sync as a serial pipeline rather than a fan-out. The per-minute and per-day call budgets are listed on the connector's Overview and on Exact's [API limits](https://support.exactonline.com/community/s/article/All-All-DNO-Simulation-gen-apilimits?language=en_GB) page.
- **Repeated errors get you blocked.** Around ten 4xx responses per key, user, company and endpoint within an hour trigger a temporary block for the rest of that hour, so back off on failures instead of retrying tightly.

## 6. Test your connection

Now that your Exact Online connector is configured, test the connection:

1. Open **Test Vault** from the connector configuration
2. Select your **API domain**, the country instance of the account you are testing with, and click **Save**. Vault does not show **Authorize** until the domain is saved; without one the connector would default to the Dutch instance.

  ![Select domain](https://res.cloudinary.com/apideck/image/upload/v1755863846/docs/connectors/exact-online/vault-config.png)

3. Click **Authorize** to authorize the connection
4. You will be redirected to the matching Exact Online domain to sign in
5. Once authorized, the connection status changes to **Connected**

  ![Connected status](https://res.cloudinary.com/apideck/image/upload/v1755863845/docs/connectors/exact-online/vault-authorization.png)

## FAQ and troubleshooting

**Authorization fails with a 401 or an invalid redirect error.** The redirect URI in your Exact app registration must be character-for-character `https://unify.apideck.com/vault/callback`. Exact rejects `localhost` and non-HTTPS values outright.

**A consumer in another country cannot authorize.** App registrations are per country instance, and this connector configuration holds a single Client ID and Secret for every connection made through it: the API domain is chosen per connection, but the credentials are not. So one `exact-online` configuration can only serve the country whose app you registered. Use the region-pinned connector for the other country (**Exact Online NL**, **Exact Online UK**), or give that region its own connector configuration with that country's app credentials.

**A consumer on another Exact Online tenant cannot connect.** Until the app passes Exact's review it is limited to the instance that created it. Submit it for review from your app registration.

**Payments or bill payments fail with 403 "AppScopeViolated ... Cannot read 'financial.cashflow' scope", but other resources work.** Your app registration lacks cash-flow access. Add it under **Submit for review > Data & security review** and resubmit. The connection itself shows as **Connected** while payment calls fail, and invoices still list — but their `balance` is `null`, because it is derived from the same cash-flow area. Once Exact has approved the review (usually within 5 working days), retry the call; if it still returns the same error, have the consumer re-authorize the connection once so it picks up the new scope.

**There is no Partners menu, or no Submit for review on the app.** The account you signed in with has no developer subscription, so it cannot manage scopes or connect other companies. Sign up through Exact's [Sign up for a developer's subscription](https://support.exactonline.com/community/s/article/All-All-DNO-Content-developerssubscriptiont?language=en_GB) article. Exact cannot transfer an app registration between accounts, so if your existing app was registered from an ordinary account, register a new app under the developer account, set its scopes and submit it for review (sections 1, 3 and 4), then replace the Client ID and Client Secret in Apideck. Existing connections were authorized against the old app, so each consumer must authorize again.

**A connection that used to work now asks for authorization again.** The consumer revoked access in Exact Online, the authorizing user lost access, or a background token renewal failed. The consumer needs to re-authorize; nothing in your Apideck configuration changes.

**Calls start returning 429.** You are over Exact's call budget or issuing requests in parallel. Serialize the requests and add backoff. If a consumer legitimately needs a higher ceiling, that is a conversation about their Exact Online plan.

Still stuck? Reach out to [Apideck Support](https://help.apideck.com/en/articles/7774658).


[API reference](https://developers.apideck.com/apis/accounting/reference.md) · [Coverage matrix](https://developers.apideck.com/apis/accounting/coverage)