QuickBooks Online API,
done properly.

QBO uses the standard OAuth 2 authorization-code grant with refresh tokens. The catch for headless automation: you must complete the initial authorization in a browser, once, signing in as the Intuit user who owns the company file.

The pattern we ship is a one-shot bootstrap script that pops a local browser, runs the consent flow, captures the authorization code on a localhost callback, exchanges it for the first access + refresh token pair, and writes them to disk encrypted. Every automation run loads the refresh token, mints a fresh access token (~1 hour TTL), issues its queries, and rotates the refresh token on disk.

After the one-time bootstrap, the integration runs unattended. We've had production runs go 11 months between manual interventions.

python -m scripts.qb_oauth_bootstrap

# opens browser to Intuit consent screen
# user signs in once, grants access
# script captures code on http://localhost:8000/cb
# exchanges for tokens, writes encrypted to cache/qbo/tokens.json
# done. every subsequent run reads from disk.

Every QBO entity carries a SyncToken. You can't write to an entity without sending the current SyncToken back; QBO uses it to detect concurrent edits. Sparse updates (the "partial PATCH" pattern) make this manageable — but only if you actually structure your writes for them.

The default Intuit pattern is "full update": fetch the whole invoice, modify the one field you care about, send the whole thing back. It works. It also writes to every field, advances the sync token, and turns every minor change into a major audit-log entry.

Sparse updates take a single field, a SyncToken, and an sparse: true flag. QBO updates only that field, advances the token, and leaves everything else untouched.

def set_tracking_number(invoice_id, sync_token, tracking_num):
    payload = {
        "Id": invoice_id,
        "SyncToken": sync_token,
        "sparse": True,
        "TrackingNum": tracking_num,
    }
    response = self.post(f"/invoice", json=payload)
    return response.json()["Invoice"]   # new sync token comes back

This isn't lifted from a Stack Overflow answer. The patterns on this page came out of shipping a real production integration for Raw Blend — a multi-store Shopify business writing ~50 invoice updates per hour against QBO, across six storefronts, with zero sync conflicts to date.

If your business runs on QuickBooks Online and you need it to do something it doesn't do out of the box — talk to us. We've already paid the discovery costs that eat up most projects.