# Fortnox — Accounting API: configuration

> Canonical URL: https://developers.apideck.com/apis/accounting/fortnox/configuration

# How to create your own OAuth integration in Fortnox

**This guide is optional.** Apideck ships temporary shared sandbox credentials for Fortnox, so you
can connect real Fortnox accounts without registering anything with Fortnox yourself: the OAuth
consent screen your customers see will simply show Apideck's integration name.

Follow the steps below when you want your **own** Client Id and Client Secret, typically for custom
branding on the consent screen or to keep the OAuth relationship in your own name.

If the temporary shared sandbox credentials are enough for now, skip straight to the
[Apideck Fortnox connector settings](https://platform.apideck.com/configuration/accounting/fortnox)
and enable the connector.

## Before you start: getting access to the Developer Portal

The Fortnox Developer Portal is free, but how you get access depends on whether you're new to
Fortnox or already have an account:

- **New to Fortnox?** Sign up as a developer directly at
  [apps.fortnox.se/integration-developer/signup](https://apps.fortnox.se/integration-developer/signup).
  You'll need a Fortnox company with an organisation number: create one during signup if you
  don't already have one. Once your account exists, you reach the Developer Portal the same way
  as any user: through **Mitt Fortnox**, as described in step 1 below.
- **Already a Fortnox subscriber?** Go through your existing account instead:
  - A **system administrator** on the account raises a support ticket with Fortnox asking for the
    developer portal module to be added.
  - Once Fortnox has added it, the licence is assigned **per user**: the administrator grants it
    to each individual who needs portal access.
  - The user then has to **log out of Fortnox and log back in**. The menu item does not appear
    until the session is refreshed.

If you took the existing-subscriber path, a missing **Utvecklarportal** menu item is almost always
one of those three steps not being finished, not a fault. See Fortnox's own
[getting started with the Developer Portal](https://support.fortnox.se/kom-igang/integrationer/kom-igang-med-utvecklarportalen)
article and the [Developer Portal overview](https://www.fortnox.se/developer/developer-portal).

## 1. Open the Developer Portal

The Developer Portal lives **inside the logged-in Fortnox application**, not on the public
fortnox.se website, and it has no direct URL. To reach it:

1. Go to [fortnox.se](https://www.fortnox.se) and open **Mitt Fortnox**.
2. Sign in to the Fortnox app.
3. Open the **Menu** in the top left.
4. Choose **Utvecklarportal**.

![Fortnox app menu with Utvecklarportal highlighted](https://res.cloudinary.com/apideck/image/upload/v1785337288/docs/connectors/fortnox/fortnox-get-started.png)

## 2. Create the integration

The portal renders in English under the heading **Welcome to the Developer Portal**, with
**Create integration** and **Edit integration** buttons.

Click **Create integration** and give it a name your customers will recognise: this name is shown
to them when they approve access to their Fortnox account.

![Fortnox Developer Portal welcome page with Create integration button](https://res.cloudinary.com/apideck/image/upload/v1785337289/docs/connectors/fortnox/fortnox-dev-portal.png)

## 3. Copy the Client Id and Client Secret

Immediately after creating the integration, Fortnox shows a **Well done!** confirmation containing
your **Client Id** and **Client Secret**. The secret is masked: click **Show client secret** to
reveal it.

You can return to both values at any time via **Edit integration**. There is no separate OAuth
settings tab.

![Fortnox confirmation page showing Client Id and masked Client Secret](https://res.cloudinary.com/apideck/image/upload/v1785337291/docs/connectors/fortnox/fortnox-copy-credentials-and-edit.png)

## 4. Select the permissions

Scopes are configured in the **Permissions** section of the integration (Fortnox does not use the
word "Scopes" here). Enable the twelve permissions below: Apideck requests exactly these during
the OAuth flow by default, and Fortnox rejects an authorization that requests a permission your
integration does not have ("An unsupported scope was requested"). One further permission,
`settings`, is optional (see below).

The same twelve items are named differently on each surface, so the table maps all three:

| Fortnox **Permissions** label | Apideck / API scope | What your customer sees (Swedish consent) | Purpose |
| ----------------------------- | -------------------- | ----------------------------------------- | ------- |
| Customer | `customer` | Kund | Read and write customer records |
| Supplier | `supplier` | Leverantör | Read and write supplier records |
| Invoice | `invoice` | Faktura | Read and write customer invoices |
| Supplier Invoice | `supplierinvoice` | Leverantörsfaktura | Read and write supplier invoices (bills) |
| Bookkeeping | `bookkeeping` | Bokföring | Read and write vouchers, accounts, and financial years |
| Payments | `payment` | Betalningar | Read and write invoice payments |
| Article | `article` | Artikel | Read and write articles (products) |
| Company Information | `companyinformation` | Företagsinformation | Read company information |
| Order | `order` | Order | Read and write purchase orders |
| Archive | `archive` | Arkivplats | Read and write attachments / inbox |
| Project | `project` | Projekt | Read and write projects (tracking categories) |
| Connect Files | `connectfile` | Koppla filer | Connect uploaded files to invoices, supplier invoices, and vouchers |

Two things worth knowing before you tick the boxes:

- **Fortnox scopes have no read-only variant.** Every scope grants both read and write access to
  its endpoints; Fortnox does not split them, so read-only access is not obtainable through the
  API.
- **A scope only takes effect if the customer's Fortnox company holds the matching module
  licence**: `bookkeeping` needs the Bokföring or Kundfaktura licence, for example. Enabling the
  permission on your integration does not grant that licence. Fortnox's
  [scopes reference](https://www.fortnox.se/developer/guides-and-good-to-know/scopes) has the full
  scope-to-licence table.

**Optional: `settings` (Settings / Inställningar).** Fortnox only exposes the company's locked
period, the source of the fiscal period `status` and `locked_through`, through this scope.
Apideck does not request it by default, so existing connections keep their consent and need no
re-authorization. Without it, fiscal periods return `status` and `locked_through` as null. To
enable it, tick Settings in the Fortnox Permissions section, add `settings` in the **Scopes** panel
of the Apideck connector (step 6), and have your customers re-authorize their connection: Fortnox
only applies new scopes to a new authorization.

Refresh tokens are issued automatically by Fortnox; there is no separate permission for them.

![Fortnox Permissions section with the twelve required permissions selected](https://res.cloudinary.com/apideck/image/upload/v1785337290/docs/connectors/fortnox/fortnox-set-scopes.png)

## 5. Add the redirect URI

In the integration's **Redirect URI** field, add exactly:

```
https://unify.apideck.com/vault/callback
```

Fortnox checks this value at authorization time: the `redirect_uri` in the authorization request
"must match the Redirect URI for the app set in the Developer Portal"
([Fortnox authorization-code reference](https://www.fortnox.se/developer/authorization/get-authorization-code)).
Enter it character for character: no trailing slash, no extra query parameters, no fragment.

![Fortnox Redirect URI field containing the Apideck Vault callback URL](https://res.cloudinary.com/apideck/image/upload/v1785337288/docs/connectors/fortnox/fortnox-add-redirect-uri.png)

## 6. Enter the credentials in the Apideck Dashboard

Open the [Apideck Fortnox connector settings](https://platform.apideck.com/configuration/accounting/fortnox)
in the Apideck Dashboard, choose the option to use your own client credentials, and paste in the
**Client Id** and **Client Secret** from step 3.

![Apideck Fortnox connector configuration with credentials options](https://res.cloudinary.com/apideck/image/upload/v1785337289/docs/connectors/fortnox/apideck-dashboard-config.png)

Then open the **Scopes** panel on the same connector and confirm the twelve scopes from step 4 are
requested (add `settings` there only if you opted in). The Apideck scope strings are the values in the second column of that table.

![Apideck Fortnox scopes panel listing the twelve scopes](https://res.cloudinary.com/apideck/image/upload/v1785337288/docs/connectors/fortnox/apideck-dashboard-scopes.png)

From here on the credential handoff is complete: your customers authorize Fortnox themselves in
Vault, and Apideck stores and refreshes their tokens against your Client Id and Client Secret. You
never handle a customer's Fortnox login.

## 7. Optional: enable virtual webhooks

Fortnox has no native webhooks, so Apideck offers
[virtual webhooks](https://help.apideck.com/en/articles/4231234) instead. Enable the resource
families you want to be notified about in the connector's webhook settings.

![Apideck Fortnox virtual webhooks resource list](https://res.cloudinary.com/apideck/image/upload/v1785337289/docs/connectors/fortnox/apideck-dashboard-webhooks.png)

## Testing your integration

Fortnox runs one environment: test databases share the same API base URL and the same Client Id
and Client Secret as live accounts, so there is no separate sandbox app to register and nothing
extra to configure. That holds whether you are on Apideck's temporary shared sandbox credentials or
on your own.

Create test companies from the Developer Portal: up to 30 can exist at a time; they are
self-service to create and delete, and Fortnox emails the login details to the user who created
them. Then connect one through Vault exactly as a customer would, using the same integration you
just registered.

Because test and live accounts are not separated by credentials, double-check which company you
are signed in to before authorizing.

## Optional: publishing on the Fortnox Appmarket

A private integration is fully supported: it can serve production traffic without ever being
listed, and nothing in this guide changes if you keep it unlisted.

Listing it on the [Fortnox Appmarket](https://www.fortnox.se/developer) is a separate track. You
sign the Fortnox App Partner agreement and submit the integration for review, which covers the
software, the integration itself, your landing page, contact information, pricing, and end-user
agreement. Ask your Fortnox contact for an expected timeline.

If you monetise a listed integration, Fortnox bills the customer (a 30-day free trial, then
quarterly or annual billing) and pays you 75% of that revenue, keeping 25%. You can instead sell
independently and bill the customer yourself, in which case they only need a Fortnox integration
licence to activate the connection. Fortnox's
[pricing models](https://www.fortnox.se/developer/guides-and-good-to-know/pricing-models) page
covers both.

## Rotating the Client Secret or deleting the integration

Both actions live under the **Risk Zone** section of the integration in the Developer Portal.

If you rotate the Client Secret, paste the new value into the
[Apideck Fortnox connector settings](https://platform.apideck.com/configuration/accounting/fortnox)
straight away: existing connections stop refreshing until the stored secret matches. Deleting the
integration invalidates every token issued under it, and all of your customers will need to
authorize again.

## FAQ and troubleshooting

### The Utvecklarportal menu item is missing

New-developer signups include Developer Portal access from registration. If you cannot find the
menu item, sign out of Fortnox and back in, and contact Fortnox support via the Developer Portal
help pages linked above if it still does not appear. If you got access through an existing Fortnox
subscription, work through the three steps in
[getting access to the Developer Portal](#before-you-start-getting-access-to-the-developer-portal)
above: most often the licence has been added to the account but not assigned to your user, or it
has been assigned and the user has not yet logged out and back in.

### Error: scope mismatch during authorization

The permissions enabled on your Fortnox integration do not match the scopes Apideck requests. Open
the integration via **Edit integration**, go to the **Permissions** section, and confirm all twelve
entries from step 4 are ticked.

### Error: invalid redirect URI

The redirect URI on your Fortnox integration must be exactly
`https://unify.apideck.com/vault/callback`: no trailing slash, no query parameters, no fragment.
Fortnox matches the value character for character.

### Do I need a service account or the client_credentials grant?

No. Fortnox does offer a `client_credentials` grant for service accounts, but it only becomes
usable after a customer has already consented through the standard OAuth flow with
`account_type=service`. This connector authorizes with the authorization-code flow, so there is
nothing extra to enable on your integration.

### A connection stopped working

Apideck refreshes and rotates Fortnox tokens automatically. Fortnox refresh tokens rotate on every
use and lapse after 45 days without one, so a connection left completely idle for longer than that,
or one whose Client Secret was rotated, needs a fresh authorization: ask the customer to
authorize Fortnox again in Vault.

Still stuck? Contact [Apideck Support](https://help.apideck.com/en/articles/7774658).


[API reference](https://developers.apideck.com/apis/accounting/reference.md) · [Coverage matrix](https://developers.apideck.com/apis/accounting/coverage)