1. Create an app in the Intuit Developer portal
1
Sign in to the Intuit Developer portal
Go to developer.intuit.com and sign in, or create a free account. Use an account of a QuickBooks admin: only an admin can authorize the company in step 2.
2
Create the app
Open My Hub > App dashboard and create an app with the com.intuit.quickbooks.accounting scope. Name it so your team recognizes it, for example “Neo Agent”.
3
Get production keys
Open the app, then Keys and credentials > Production. Intuit asks for your app details (a host domain, launch and disconnect URLs, an end user licence agreement and a privacy policy URL) and an app assessment questionnaire before it shows production keys. A private app used only by your own company is enough; you do not publish it on the Intuit App Store. Once Intuit approves the questionnaire, copy the Client ID and the Client Secret.
4
Allow the OAuth 2.0 Playground
In the app’s Settings > Redirect URIs, on the Production tab, add
https://developer.intuit.com/v2/OAuth2Playground/RedirectUrl and save.2. Authorize your company and copy the refresh token
1
Open the OAuth 2.0 Playground
Open the OAuth 2.0 Playground. Under Select app, choose your app with its production keys, and select the com.intuit.quickbooks.accounting scope.
2
Connect your company
Select Get authorization code, sign in as a QuickBooks admin, choose your company and select Connect. The Playground shows the Authorization code and the Realm ID. Copy the Realm ID.
3
Get the tokens
Select Get tokens and copy the Refresh token.
3. Save the keys in Neo
1
Open Integrations
In the Neo Dashboard, open Integrations → QuickBooks Online, under Accounting.
2
Enter the values
Paste the Client ID, Client Secret, Refresh Token and Realm ID. Click Save.Neo uses the refresh token with Intuit before it saves, then reads your company with the new access token. Wrong app keys or a token that no longer works are refused on the spot. When the new token cannot read the company (a Realm ID of another company, or a user who is no longer a QuickBooks admin), the save fails. Neo keeps the token Intuit returned, so reload the page, correct the Realm ID or authorize as an admin, and save again.
Keep the connection alive
A refresh token expires after 100 days without use. Neo maps your QuickBooks customers to PSA companies after each PSA sync, and that run renews the token, so an account whose PSA keeps syncing stays connected. Intuit also ends every authorization after five years; then you authorize again. If Intuit refuses the token, for example after someone disconnected the app in QuickBooks or used the same token elsewhere, Neo shows an action item in your inbox and emails your admin. Get a new refresh token in the Playground, as in step 2, and save it in Neo.4. Turn QuickBooks Online on per agent
Each agent decides whether it uses QuickBooks Online and which areas it can touch. Open the agent, go to the Integrations section, and configure the QuickBooks Online block.Pick an access profile
Read Only
Every area read only, emails off. The agent searches invoices, customers, payments and reports, and never changes anything.
Helpdesk
Customers and Employees & Time read and write, each change with technician approval. Everything else read only, emails off.
IT Admin
Every writable area read and write. The agent creates and updates customers, invoices, payments, bills, products and time on its own. Emails to customers and vendors, journal and account changes, and company settings wait on a technician.
Full Automation
Every supported write runs with no approval, emails to customers and vendors included.
Or set each area by hand
Safety controls
- You set the approvals. Each area has its own approval setting, so an agent can record a payment on its own, or ask a technician first.
- Emails are their own area. An agent that can write invoices cannot email one to your client unless you turn on Emails to Customers & Vendors.
- A search reads one area. Neo reads which record type a search asks for and checks the area for it, so an agent with Sales & Invoices cannot search your employees.
- A delete or void names its record. Neo refuses one without the record’s id and sync token, so when the area asks for approval, the technician approves the exact record.
- Only documented operations. Neo sends only the operations in Intuit’s Accounting API reference, each with its own method, and refuses any other call.
- Files stay in QuickBooks. Neo does not download PDFs or attachments, and does not upload files.
- Path safety. Neo rejects suspicious URL paths (anything that contains
.., for example) before they reach QuickBooks.
If QuickBooks refuses Neo’s requests
Disconnecting QuickBooks Online
1
Open the integration
In the Neo Dashboard, open Integrations and select the QuickBooks Online card.
2
Disconnect
Click Disconnect and confirm. Neo removes the keys from Key Vault and stops using its cached access token. To end the authorization at Intuit as well, disconnect the app in QuickBooks under Apps.
Security
- The Client Secret and the refresh token are stored in Azure Key Vault, never in plaintext.
- All traffic to Intuit goes over HTTPS, to
quickbooks.api.intuit.comandoauth.platform.intuit.comonly. - Write access is opt-in per agent.