How to create your own OAuth integration in Fortnox

This guide is optional. Apideck ships temporary shared sandbox credentials for Fortnox, so you can connect real Fortnox accounts without registering anything with Fortnox yourself — the OAuth consent screen your customers see will simply show Apideck's integration name.

Follow the steps below when you want your own Client Id and Client Secret, typically for custom branding on the consent screen or to keep the OAuth relationship in your own name.

If the temporary shared sandbox credentials are enough for now, skip straight to the Apideck Fortnox connector settings and enable the connector.

Before you start: getting access to the Developer Portal

The Fortnox Developer Portal is free, but how you get access depends on whether you're new to Fortnox or already have an account:

• New to Fortnox? Sign up as a developer directly at apps.fortnox.se/integration-developer/signup. You'll need a Fortnox company with an organisation number — create one during signup if you don't already have one. Once your account exists, you reach the Developer Portal the same way as any user: through Mitt Fortnox, as described in step 1 below.
• Already a Fortnox subscriber? Go through your existing account instead:
  • A system administrator on the account raises a support ticket with Fortnox asking for the developer portal module to be added.
  • Once Fortnox has added it, the licence is assigned per user — the administrator grants it to each individual who needs portal access.
  • The user then has to log out of Fortnox and log back in. The menu item does not appear until the session is refreshed.

If you took the existing-subscriber path, a missing Utvecklarportal menu item is almost always one of those three steps not being finished — not a fault. See Fortnox's own getting started with the Developer Portal article and the Developer Portal overview.

1. Open the Developer Portal

The Developer Portal lives inside the logged-in Fortnox application, not on the public fortnox.se website, and it has no direct URL. To reach it:

1. Go to fortnox.se and open Mitt Fortnox.
2. Sign in to the Fortnox app.
3. Open the Menu in the top left.
4. Choose Utvecklarportal.

2. Create the integration

The portal renders in English under the heading Welcome to the Developer Portal, with Create integration and Edit integration buttons.

Click Create integration and give it a name your customers will recognise — this name is shown to them when they approve access to their Fortnox account.

3. Copy the Client Id and Client Secret

Immediately after creating the integration, Fortnox shows a Well done! confirmation containing your Client Id and Client Secret. The secret is masked — click Show client secret to reveal it.

You can return to both values at any time via Edit integration. There is no separate OAuth settings tab.

4. Select the permissions

Scopes are configured in the Permissions section of the integration (Fortnox does not use the word "Scopes" here). Enable all twelve permissions below — they must match exactly what Apideck requests during the OAuth flow, or authorization fails with a scope mismatch.

The same twelve items are named differently on each surface, so the table maps all three:

Fortnox Permissions label	Apideck / API scope	What your customer sees (Swedish consent)	Purpose
Customer	customer	Kund	Read and write customer records
Supplier	supplier	Leverantör	Read and write supplier records
Invoice	invoice	Faktura	Read and write customer invoices
Supplier Invoice	supplierinvoice	Leverantörsfaktura	Read and write supplier invoices (bills)
Bookkeeping	bookkeeping	Bokföring	Read and write vouchers, accounts, and financial years
Payments	payment	Betalningar	Read and write invoice payments
Article	article	Artikel	Read and write articles (products)
Company Information	companyinformation	Företagsinformation	Read company information
Order	order	Order	Read and write purchase orders
Archive	archive	Arkivplats	Read and write attachments / inbox
Project	project	Projekt	Read and write projects (tracking categories)
Connect Files	connectfile	Koppla filer	Connect uploaded files to invoices, supplier invoices, and vouchers

Two things worth knowing before you tick the boxes:

• Fortnox scopes have no read-only variant. Every scope grants both read and write access to its endpoints; Fortnox does not split them, so read-only access is not obtainable through the API.
• A scope only takes effect if the customer's Fortnox company holds the matching module licence — bookkeeping needs the Bokföring or Kundfaktura licence, for example. Enabling the permission on your integration does not grant that licence. Fortnox's scopes reference has the full scope-to-licence table.

Refresh tokens are issued automatically by Fortnox; there is no separate permission for them.

5. Add the redirect URI

In the integration's Redirect URI field, add exactly:

https://unify.apideck.com/vault/callback

Fortnox checks this value at authorization time: the redirect_uri in the authorization request "must match the Redirect URI for the app set in the Developer Portal" (Fortnox authorization-code reference). Enter it character for character — no trailing slash, no extra query parameters, no fragment.

6. Enter the credentials in the Apideck Dashboard

Open the Apideck Fortnox connector settings in the Apideck Dashboard, choose the option to use your own client credentials, and paste in the Client Id and Client Secret from step 3.

Then open the Scopes panel on the same connector and confirm the twelve scopes from step 4 are requested. The Apideck scope strings are the values in the second column of that table.

From here on the credential handoff is complete: your customers authorize Fortnox themselves in Vault, and Apideck stores and refreshes their tokens against your Client Id and Client Secret. You never handle a customer's Fortnox login.

7. Optional: enable virtual webhooks

Fortnox has no native webhooks, so Apideck offers virtual webhooks instead. Enable the resource families you want to be notified about in the connector's webhook settings.

Testing your integration

Fortnox runs one environment: test databases share the same API base URL and the same Client Id and Client Secret as live accounts, so there is no separate sandbox app to register and nothing extra to configure. That holds whether you are on Apideck's temporary shared sandbox credentials or on your own.

Create test companies from the Developer Portal — up to 30 can exist at a time, they are self-service to create and delete, and Fortnox emails the login details to the user who created them. Then connect one through Vault exactly as a customer would, using the same integration you just registered.

Because test and live accounts are not separated by credentials, double-check which company you are signed in to before authorizing.

Optional: publishing on the Fortnox Appmarket

A private integration is fully supported: it can serve production traffic without ever being listed, and nothing in this guide changes if you keep it unlisted.

Listing it on the Fortnox Appmarket is a separate track. You sign the Fortnox App Partner agreement and submit the integration for review, which covers the software, the integration itself, your landing page, contact information, pricing, and end-user agreement. Ask your Fortnox contact for an expected timeline.

If you monetise a listed integration, Fortnox bills the customer (a 30-day free trial, then quarterly or annual billing) and pays you 75% of that revenue, keeping 25%. You can instead sell independently and bill the customer yourself, in which case they only need a Fortnox integration licence to activate the connection. Fortnox's pricing models page covers both.

Rotating the Client Secret or deleting the integration

Both actions live under the Risk Zone section of the integration in the Developer Portal.

If you rotate the Client Secret, paste the new value into the Apideck Fortnox connector settings straight away — existing connections stop refreshing until the stored secret matches. Deleting the integration invalidates every token issued under it, and all of your customers will need to authorize again.

FAQ and troubleshooting

The Utvecklarportal menu item is missing

New-developer signups include Developer Portal access from registration. If you cannot find the menu item, sign out of Fortnox and back in, and contact Fortnox support via the Developer Portal help pages linked above if it still does not appear. If you got access through an existing Fortnox subscription, work through the three steps in getting access to the Developer Portal above — most often the licence has been added to the account but not assigned to your user, or it has been assigned and the user has not yet logged out and back in.

Error: scope mismatch during authorization

The permissions enabled on your Fortnox integration do not match the scopes Apideck requests. Open the integration via Edit integration, go to the Permissions section, and confirm all twelve entries from step 4 are ticked.

Error: invalid redirect URI

The redirect URI on your Fortnox integration must be exactly https://unify.apideck.com/vault/callback — no trailing slash, no query parameters, no fragment. Fortnox matches the value character for character.

Do I need a service account or the client_credentials grant?

No. Fortnox does offer a client_credentials grant for service accounts, but it only becomes usable after a customer has already consented through the standard OAuth flow with account_type=service. This connector authorizes with the authorization-code flow, so there is nothing extra to enable on your integration.

A connection stopped working

Apideck refreshes and rotates Fortnox tokens automatically. Fortnox refresh tokens rotate on every use and lapse after 45 days without one, so a connection left completely idle for longer than that — or one whose Client Secret was rotated — needs a fresh authorization: ask the customer to authorize Fortnox again in Vault.

Still stuck? Contact Apideck Support.