Skip to main content

Authentication

Every Quickbook API request is authenticated with an HTTP Authorization header that carries your API access token. There are no OAuth flows or session cookies — just the header.

Sending your credentials​

Pass your client id and client secret together, prefixed with AL and separated by a colon:

Authorization: AL client_id:client_secret
curl "$QB_BASE/v1/products?account=477601" \
  -H "Authorization: AL your_client_id:your_client_secret"

If the client id or secret is invalid, the API returns 401 Unauthorized with the body:

Invalid client_id or client_secret

Requests that reach the API with a missing, malformed, or otherwise non-compliant Authorization header are rejected by the security policy with a 403:

{
  "error": "invalid_client",
  "description": "wrong client_id or client_secret"
}

See Errors for the full list of status codes.

Keeping credentials safe​

  • Never embed your client secret in client-side code or commit it to version control.
  • Rotate credentials immediately if either value is exposed.
  • Prefer environment variables or a secrets manager over hard-coded strings.

In the API Reference​

Authentication applies to every endpoint. It is declared as the quickbookAuth security scheme (an Authorization header) on every operation in the API Reference.

Note: webhooks sent to your endpoint use a different scheme — HTTP Basic Auth. See Status webhooks.