quickbooks-online-kit

Connecting an app to QuickBooks Online is a one-time consent screen. Keeping it connected is the real job: Intuit access tokens last about an hour, and every time you refresh one, the response includes a new refresh token that replaces the old one.

1. Connect (OAuth2)↓→
2. Token store↓→
3. Refresh-token rotation↓→
4. Typed REST client↓→
5. Audit log

Three ways this goes wrong

• Five requests arrive at the same moment the token expires. Each refreshes, the first wins, the others hold a dead token, and the customer has to reconnect.
• You get a new refresh token, crash before saving it, and the old one is gone.
• Two servers refresh at once and one loses the race.

What the token manager does

• Concurrent callers in one process share one refresh request.
• The rotated refresh token is saved before the new access token is handed out.
• If a refresh is rejected but another process already stored a newer token, it adopts that one instead of failing.
• Sandbox tokens are never used against production.

Watch it happen

A fake Intuit server runs in your browser. Let an hour pass, make five calls at once, and count the refresh requests.

Never double-invoice

The client turns an estimate into an invoice once, and a repeat is refused with an ALREADY_INVOICED error. The repository quickstart runs the whole flow offline against an in-process fake of Intuit's OAuth and REST endpoints.

invoice total 300 | second conversion: ALREADY_INVOICED

What this does not do

• It is a v0.1 reference implementation extracted from an internal integration. Read the README for what has and has not been run against the live service.
• It defaults to the sandbox environment; anything other than production resolves to sandbox.
• In this demo's browser copy, file-based audit logging is removed.