How to create an OAuth app in Visma eAccounting

This guide is for you, the Apideck customer building an integration. It covers registering for API access with Visma/Spiris, getting your Client ID and Client Secret, registering the Apideck redirect URL, and entering the credentials in the Apideck Dashboard.

Visma eAccounting authenticates with OAuth 2.0 (authorization code). Your consumers never see your client credentials — they only sign in with their own Visma Online login and pick a company (see the connection guide).

Two things about this platform shape the setup, so plan for both:

Visma has rebranded the product to Spiris, so the developer portal, contracts and support contacts you will deal with often carry the Spiris name even though the connector, the API host and the scopes still say eAccounting.
Registration gives you a sandbox client. Production credentials are issued separately, on request, by Visma/Spiris API support — see step 5. Start step 5 early if you have a launch date.

Before you start

A company or developer identity you can register for API access with.
An Apideck account with the Visma eAccounting connector enabled.
Decide which market you are integrating for — Sweden, Norway or the Netherlands. The API is the same, but the partner contact who registers your redirect URL and issues production credentials differs per country (see step 2 and step 5).
Skim step 3 before you register: it lists the five scopes your client needs, and you will refer back to it in step 2 and step 5.

1. Register for API access and get sandbox credentials

Registration is self-service. After you sign up, Visma emails you:

a sandbox Client ID and Client Secret, and
access to a sandbox eAccounting / Bokföring & Fakturering test company to develop against.

Sandbox companies are provided for application development only — they are not a general-purpose demo or customer environment.

Store the Client Secret in your secret manager as soon as the email arrives, and treat that email as your only copy. If you do lose it, ask the regional contact in step 2 what their reissue process is.

Vendor reference: Visma eAccounting developer documentation.

2. Register the Apideck redirect URL

Your OAuth app must accept Apideck's callback, and this URL is not self-service — it is registered for you by the Visma/Spiris partner contact for your market.

Redirect URL to register, exactly as written:

https://unify.apideck.com/vault/callback

Email the redirect URL to the contact for your market and ask for it to be added to your app's allowed redirect URIs, for both your sandbox and (later) your production client. While you have them, confirm your client is granted the five scopes in step 3.

Market	Contact
Sweden	`api@spiris.se`
Norway	`api_eaccounting@visma.com`
Netherlands	`partner.eaccounting@visma.com`

Do this before you test through Vault, not just before you go live. Until https://unify.apideck.com/vault/callback is registered on the client you configure in the Apideck Dashboard, every authorization attempt fails at the Visma sign-in screen with a redirect URI error. Do not assume a newly issued client already has a usable callback: Apideck's own shared sandbox client was issued with a localhost placeholder that does not work with Vault, so check yours with your regional contact rather than testing on the assumption it is set.

Do not register a vendor-hosted or localhost callback for the Apideck connection. Apideck always sends consumers back to the URL above.

3. Confirm the right scopes

Apideck requests all five scopes below together on every authorization, so your client has to be granted all of them — a client that is missing one will fail on the resources that scope covers, or will not return a refresh token at all.

Scope	What it grants
`ea:api`	Access to the eAccounting API
`ea:sales`	Read/write sales resources — invoices, customers, orders
`ea:purchase`	Read/write purchase resources — supplier invoices
`ea:accounting`	Read/write accounting resources — vouchers, accounts
`offline_access`	Issues a refresh token so the connection stays authorized after the access token expires

Use this list twice: ask your regional contact from step 2 to confirm your sandbox client grants all five (and to add any that are missing), and include the same list in your production credentials request in step 5.

offline_access is not optional for an Apideck connection. Without it, Visma returns only a short-lived access token and the connection stops working roughly an hour after each authorization.

4. Add the credentials in the Apideck Dashboard

Open the Visma eAccounting connector settings in the Apideck Dashboard.

Select Use your own client credentials.
Fill in:

Field Value
Client ID The Client ID from your Visma/Spiris registration email
Client Secret The matching Client Secret
Click Save settings.

Field	Value
Client ID	The Client ID from your Visma/Spiris registration email
Client Secret	The matching Client Secret

The secret is stored encrypted and masked after saving, so keep your own copy.

There is nothing else to configure: the connector has no consumer-supplied settings — no realm id, subdomain or region field. Your consumers choose their company inside the Visma authorization screen, and Apideck reads the tenant from the issued token.

OAuth endpoints Apideck uses

You do not call these yourself — Apideck runs the flow — but they are useful if you need to allow-list hosts or debug a failed authorization:

Purpose	Endpoint
Authorization	`https://identity.vismaonline.com/connect/authorize`
Token and refresh	`https://identity.vismaonline.com/connect/token`

Access tokens live 3600 seconds; Apideck refreshes them automatically using the refresh token granted by offline_access.

5. Request production credentials

Production credentials are not issued through the self-service site. When your integration is ready for live customer data, request a production client from Visma/Spiris API support using the same regional contact as in step 2:

Market	Contact
Sweden	`api@spiris.se`
Norway	`api_eaccounting@visma.com`
Netherlands	`partner.eaccounting@visma.com`

In the request, include:

your company and a description of the integration,
the five scopes listed in step 3,
the redirect URL https://unify.apideck.com/vault/callback,
the markets whose customers you will onboard.

Visma/Spiris does not publish a review turnaround for production access, so ask your contact for an expected timeline and for anything else they need from you, rather than planning around an assumed one.

When the production Client ID and Secret arrive, replace the sandbox values in the same two fields in the connector settings and save. Nothing else in the Apideck configuration changes between sandbox and production — the environment is determined solely by which client credentials the connector is configured with, so consumer connections created against the sandbox client have to be reauthorized after you swap.

What you get on registration is a sandbox company rather than a separate sandbox environment: the connector reaches it over the same API host and the same identity server as production. If your contact issues you credentials for a separate Visma sandbox host instead, tell us before you go live — the connector is configured for the production host only and has no environment switch.

6. Onboard your consumers

Each consumer authorizes from Vault with their own Visma Online login and selects the company they want to grant access to. Point them at the connection guide.

FAQ and troubleshooting

Authorization fails immediately with a redirect URI error. https://unify.apideck.com/vault/callback has not been registered on the client you configured in the Apideck Dashboard. Email the regional contact from step 2 and confirm the exact URL was added — a trailing slash or a different scheme makes it a different URI.

Authorization succeeds but the connection stops working about an hour later. The client was not granted offline_access, so no refresh token was issued. Ask Visma/Spiris to add the scope to your client, then have the consumer reauthorize.

A consumer's connection breaks even though nothing changed on your side. A consumer changing their Visma Online password silently invalidates the refresh token. The connection keeps looking healthy until the next call fails, and the consumer has to reauthorize. This is normal Visma behaviour, not a misconfiguration — see the connection guide troubleshooting.

Some resources return 403 while others work. The client is missing one of the four ea: scopes. ea:sales, ea:purchase and ea:accounting each gate a distinct slice of the API; request the missing one from your regional contact.

Consumers see the wrong brand on the consent screen. The consent screen shows the name registered on the OAuth client. If it is not the name you want your customers to see, ask your Visma/Spiris contact to update the client's display name.

For anything on the Apideck side of the configuration, contact Apideck Support.

Reference

Visma eAccounting developer documentation — API reference and authentication details
Developer self-service registration — sandbox credentials and test company
Visma eAccounting — the product your consumers sign in to
Apideck Visma eAccounting connector settings