How to create your own OAuth integration in Fortnox

This guide is optional. Apideck ships shared Fortnox credentials, so you can go live without registering anything with Fortnox — the OAuth consent screen your customers see will simply show Apideck's integration name. Follow the steps below only if you want your own Client Id and Client Secret, typically for custom branding on the consent screen or to keep the OAuth relationship in your own name.

If you are happy with the shared credentials, skip straight to the Apideck Fortnox connector settings and enable the connector.

Before you start: getting access to the Developer Portal

The Fortnox Developer Portal is free, but how you get access depends on whether you're new to Fortnox or already have an account:

• New to Fortnox? Sign up as a developer directly at apps.fortnox.se/integration-developer/signup. You'll need a Fortnox company with an organisation number — create one during signup if you don't already have one. Once your account exists, you reach the Developer Portal the same way as any user: through Mitt Fortnox, as described in step 1 below.
• Already a Fortnox subscriber? Go through your existing account instead:
  • A system administrator on the account raises a support ticket with Fortnox asking for the developer portal module to be added.
  • Once Fortnox has added it, the licence is assigned per user — the administrator grants it to each individual who needs portal access.
  • The user then has to log out of Fortnox and log back in. The menu item does not appear until the session is refreshed.

If you took the existing-subscriber path, a missing Utvecklarportal menu item is almost always one of those three steps not being finished — not a fault. See Fortnox's own getting started with the Developer Portal article and the Developer Portal overview.

1. Open the Developer Portal

The Developer Portal lives inside the logged-in Fortnox application, not on the public fortnox.se website, and it has no direct URL. To reach it:

1. Go to fortnox.se and open Mitt Fortnox.
2. Sign in to the Fortnox app.
3. Open the Menu in the top left.
4. Choose Utvecklarportal.

2. Create the integration

The portal renders in English under the heading Welcome to the Developer Portal, with Create integration and Edit integration buttons.

Click Create integration and give it a name your customers will recognise — this name is shown to them when they approve access to their Fortnox account.

3. Copy the Client Id and Client Secret

Immediately after creating the integration, Fortnox shows a Well done! confirmation containing your Client Id and Client Secret. The secret is masked — click Show client secret to reveal it.

You can return to both values at any time via Edit integration. There is no separate OAuth settings tab.

4. Select the permissions

Scopes are configured in the Permissions section of the integration (Fortnox does not use the word "Scopes" here). Enable all twelve permissions below — they must match exactly what Apideck requests during the OAuth flow, or authorization fails with a scope mismatch.

The same twelve items are named differently on each surface, so the table maps all three:

Fortnox Permissions label	Apideck / API scope	What your customer sees (Swedish consent)	Purpose
Customer	customer	Kund	Read and write customer records
Supplier	supplier	Leverantör	Read and write supplier records
Invoice	invoice	Faktura	Read and write customer invoices
Supplier Invoice	supplierinvoice	Leverantörsfaktura	Read and write supplier invoices (bills)
Bookkeeping	bookkeeping	Bokföring	Read and write vouchers, accounts, and financial years
Payments	payment	Betalningar	Read and write invoice payments
Article	article	Artikel	Read and write articles (products)
Company Information	companyinformation	Företagsinformation	Read company information
Order	order	Order	Read and write purchase orders
Archive	archive	Arkivplats	Read and write attachments / inbox
Project	project	Projekt	Read and write projects (tracking categories)
Connect Files	connectfile	Koppla filer	Connect uploaded files to invoices, supplier invoices, and vouchers

Refresh tokens are issued automatically by Fortnox; there is no separate permission for them.

5. Add the redirect URI

In the integration's Redirect URI field, add exactly:

https://unify.apideck.com/vault/callback

Fortnox's rules for this field:

• Separate multiple redirect URIs with a comma.
• A redirect URI must not contain parameters such as basic authentication, and must not contain a hashtag (#).
• The protocol must be https, except for localhost where http is allowed.
• Maximum length is 256 characters.
• Values are matched exactly — do not add a trailing slash.

6. Enter the credentials in the Apideck Dashboard

Open the Apideck Fortnox connector settings in the Apideck Dashboard, choose the option to use your own client credentials, and paste in the Client Id and Client Secret from step 3.

Then open the Scopes panel on the same connector and confirm the twelve scopes from step 4 are requested. The Apideck scope strings are the values in the second column of that table.

7. Optional: enable virtual webhooks

Fortnox has no native webhooks, so Apideck offers virtual webhooks instead. Enable the resource families you want to be notified about in the connector's webhook settings.

Rotating the Client Secret or deleting the integration

Both actions live under the Risk Zone section of the integration in the Developer Portal.

If you rotate the Client Secret, paste the new value into the Apideck Fortnox connector settings straight away — existing connections stop refreshing until the stored secret matches. Deleting the integration invalidates every token issued under it, and all of your customers will need to authorize again.

FAQ and troubleshooting

The Utvecklarportal menu item is missing

New-developer signups include Developer Portal access from registration. If you cannot find the menu item, sign out of Fortnox and back in, and contact Fortnox support via the Developer Portal help pages linked above if it still does not appear. If you got access through an existing Fortnox subscription, work through the three steps in getting access to the Developer Portal above — most often the licence has been added to the account but not assigned to your user, or it has been assigned and the user has not yet logged out and back in.

Error: scope mismatch during authorization

The permissions enabled on your Fortnox integration do not match the scopes Apideck requests. Open the integration via Edit integration, go to the Permissions section, and confirm all twelve entries from step 4 are ticked.

Error: invalid redirect URI

The redirect URI on your Fortnox integration must be exactly https://unify.apideck.com/vault/callback — no trailing slash, no query parameters, no fragment. Fortnox matches the value character for character.

A connection stopped working

Apideck refreshes and rotates Fortnox tokens automatically. If a connection sat unused long enough for its refresh token to lapse, or the Client Secret was rotated, the fix is a fresh authorization: ask the customer to authorize Fortnox again in Vault.

Still stuck? Contact Apideck Support.