How to Create OAuth Credentials for Exact Online

This guide will help you set up your Exact Online OAuth app and add its credentials to Apideck.

Before you begin, you'll need:

• An Exact Online account in the country instance your consumers use. Exact Online runs separate country instances (NL, BE, DE, ES, UK, US) with their own hosts and their own App Center, and an app registered in one country cannot connect consumers in another — so register one app per country you serve.
• An Exact Online developer subscription for that country if your app will connect consumers outside your own Exact Online instance. Exact charges EUR 15 per month excluding VAT per country for it (verified June 2026 — confirm the current figure on Exact's developer sign-up before you budget). An app that only ever connects your own Exact Online instance does not need a developer subscription.
• A user in that instance that is allowed to authorize third-party app connections.

Which connector am I configuring? On exact-online the consumer picks their country with the Select your API domain connection setting (Belgium, Germany, Netherlands, Spain, United Kingdom, United States). If every consumer of your integration sits in one country, the region-pinned siblings exact-online-nl and exact-online-uk have a fixed host and no region picker.

1. Create the OAuth application

Sign in to the Exact Online App Center

• Sign in to the Exact Online App Center and make sure you are in the country instance you want to register the app for. Exact's Register your app article walks through the developer sign-up (also reachable from the "Are you an app developer?" section at the bottom of the App Center) and the developer sign-up wizard.

  

Register a test app

• Click Register a test app (you can move it to production later)

  

Exact advises keeping the number of app registrations to a maximum of four (for example one per DTAP stage: development, test, acceptance, production) — plan your registrations before you create them.

Configure app details

• Enter the following details:

  • App Name: Choose a descriptive name for your app
  • Redirect URI: https://unify.apideck.com/vault/callback
  • Accept the terms and conditions

  

The redirect URI must be exactly https://unify.apideck.com/vault/callback. Exact rejects localhost and any non-HTTPS redirect URI, and a mismatch fails the authorization with an HTTP 401. Do not add a vendor or local development URL here — Apideck handles the callback for every connection.

Get your OAuth credentials

• After creating the app, note down the Client ID and Client Secret

  

💡 TIP: Copy the Client ID and Client Secret immediately. The Client Secret may only be visible once when you first create the app.

2. Add the credentials in Apideck

• Open the Exact Online connector configuration in the Apideck Dashboard
• Select Use your Exact Online client credentials
• Enter the following OAuth credentials:
  • Client ID → client_id: Paste the Client ID from your Exact Online app
  • Client Secret → client_secret: Paste the Client Secret from your Exact Online app
• Click Save settings to save your credentials

Apideck does not ship shared test credentials for this connector, so your own app credentials are what every connection uses. Because Exact Online uses the same credentials for testing and production, register and test in the same country instance your consumers are in — and be careful when testing against production data.

3. Scopes

There is nothing to select. Exact Online grants access at the app-registration level rather than per consent scope, and the connector declares the Code, Description and Division scopes itself — so there is nothing to configure either in the app registration or in Apideck.

What a connection can reach is instead bounded by the authorizing user's own Exact Online rights and by the division (administration) the connection resolves. Apideck fills the division id in automatically after authorization; your consumers never type it, and multiple companies are addressed with the x-apideck-company-id header.

4. Get your app reviewed before onboarding customers outside your own instance

A freshly registered app works immediately for consumers in the same Exact Online instance that created it — which is everything you need to build and test end to end. To connect customers on other Exact Online tenants, submit the app for Exact's internal review from the App Center; once it passes, it can serve consumers across that country instance. Ask your Exact contact for an expected timeline so you can sequence your pilot customers around it.

Publishing the app on the Exact Online App Store is a separate, optional step with its own review process. An approved app can serve external customers without being published, so App Store publication is not on the critical path for a private integration.

5. Design notes before you go live

• Token handling is Apideck's job. Access tokens last 10 minutes and Apideck refreshes them automatically. You do not store or rotate anything.
• Refresh tokens are single-use and go stale after 30 days of inactivity. Each refresh invalidates the previous token, and a connection that goes unused for 30 days needs the consumer to authorize again. If your product has seasonal or low-frequency users, plan a re-authorization prompt for them.
• Never issue Exact Online calls in parallel. Exact requires sequential requests and explicitly disallows multi-threaded calling, and it will not mint a new access token more often than once every 570 seconds. Build your sync as a serial pipeline rather than a fan-out. The per-minute and per-day call budgets are listed on the connector's Overview and on Exact's API limits page.
• Repeated errors get you blocked. Around ten 4xx responses per key, user, company and endpoint within an hour trigger a temporary block for the rest of that hour, so back off on failures instead of retrying tightly.

6. Test your connection

Now that your Exact Online connector is configured, test the connection:

1. Open Test Vault from the connector configuration
2. Select your API domain — the country instance of the account you are testing with — and click Save. Do this before authorizing: the connector defaults to the Dutch instance when no domain is selected.

3. Click Authorize to authorize the connection
4. You will be redirected to the matching Exact Online domain to sign in
5. Once authorized, the connection status changes to Connected

FAQ and troubleshooting

Authorization fails with a 401 or an invalid redirect error. The redirect URI in your Exact app registration must be character-for-character https://unify.apideck.com/vault/callback. Exact rejects localhost and non-HTTPS values outright.

A consumer in another country cannot authorize. App registrations are per country instance, and this connector configuration holds a single Client ID and Secret for every connection made through it — the API domain is chosen per connection, but the credentials are not. So one exact-online configuration can only serve the country whose app you registered. Use the region-pinned connector for the other country (Exact Online NL, Exact Online UK), or give that region its own connector configuration with that country's app credentials.

A consumer on another Exact Online tenant cannot connect. Until the app passes Exact's internal review it is limited to the instance that created it. Submit it for review from the App Center.

A connection that used to work now asks for authorization again. The refresh token expired after 30 days without use, or the consumer revoked access in Exact Online. The consumer needs to re-authorize; nothing in your Apideck configuration changes.

Calls start returning 429. You are over Exact's call budget or issuing requests in parallel. Serialize the requests and add backoff. If a consumer legitimately needs a higher ceiling, that is a conversation about their Exact Online plan.

Still stuck? Reach out to Apideck Support.