Module 5 — Capstone

Connect QuickBooks Online

This is the module the whole course has been building toward: software you built, talking to real business software, showing you something you actually care about — who owes you money and how overdue they are. Set aside an hour, maybe a bit more.

First, what's an API?

An API is how one piece of software talks to another. Here's the restaurant version: you (your app) don't walk into the kitchen (QuickBooks' computers) and rummage through it. You give an order to the waiter — "one list of unpaid invoices, please" — and the waiter carries it to the kitchen and brings back exactly what you asked for. The API is that waiter: a formal, safe way to make requests and get answers, with the kitchen's rules always enforced.

Nearly every business tool you use — QuickBooks, your bank, your scheduling software — has an API. Learning to use one means learning to use all of them, because the pattern is always the same: prove who you are, ask politely in the expected format, receive data back.

Step 1: Create a free Intuit developer account

Intuit (the company behind QuickBooks) gives developers a free account with a practice company for exactly this kind of learning.

1. Go to developer.intuit.com and click Sign up. If you already use QuickBooks or TurboTax you can sign in with that Intuit account; otherwise create one. It's free either way.
2. Once you're in, find your sandbox company: in the developer dashboard, look for Sandbox (under the API/dashboard menus). Intuit automatically provides a sandbox company — a complete fake business with customers, invoices, and payments already in it. That's your safe playground.

Step 2: Create an app to get your keys

To use the API, Intuit gives you two codes that identify your app — like a username and password for software:

1. In the developer dashboard, choose to create an app.
2. Pick QuickBooks Online and Payments as the platform, give the app any name you like ("My AR Dashboard" works), and select the Accounting permission (called a scope) when asked.
3. Open your new app's Keys & credentials section for Development. You'll see a Client ID and a Client Secret. Keep this browser tab open — you'll need both in a few minutes.
4. While you're there, add a Redirect URI of http://localhost:3000/callback — this tells Intuit where to send you back after you approve the connection. (If Claude Code later tells you it used a different address, come back here and make them match.)

Step 3: The key-safety lesson

Your Client ID is like your business's phone number — identifying, not secret. Your Client Secret is like the key to your office. Anyone who has it can pretend to be your app. So it follows three rules, and these apply to every secret key you'll ever handle:

• It goes in a .env file. A .env file is a small text file on your computer that holds secrets, kept separate from your code so the code can be shared without sharing the keys.
• It never gets pasted into a website — not into a chat window, not into an online tool, not into a form. (Remember Module 1's never-paste list? API keys were on it.)
• It never gets committed. Developers use a tool called git to save snapshots of their code (a snapshot is called a commit) — and a file named .gitignore tells git which files to always leave out of snapshots. The .env file goes in .gitignore, every time, so secrets never end up in the code's history. The prompt below tells Claude Code to set this up for you.

Exercise 3: Build the A/R aging dashboard

A/R (accounts receivable) is money customers owe you; an aging report groups it by how overdue it is. It's the report that tells you where to make collection calls. Let's build one.

In your terminal, create a project folder and start Claude Code:

mkdir ar-dashboard
cd ar-dashboard
claude

Then paste this prompt exactly as written:

Build me a small local Node.js/Express web app that shows a read-only accounts receivable aging dashboard from a QuickBooks Online SANDBOX company. I'm a beginner, so explain each step as you go.

Requirements:

1. Credentials and safety:
   - Put my Intuit Client ID, Client Secret, and redirect URI in a .env file with clearly labeled placeholder values I will fill in myself. Never print the secret anywhere.
   - Create a .gitignore that excludes .env and node_modules.
   - The app must be READ-ONLY: it only queries data, never creates or modifies anything.

2. Connecting to QuickBooks:
   - Implement OAuth 2.0 against Intuit's SANDBOX environment (use Intuit's official Node OAuth client library if that's simplest), with a redirect URI of http://localhost:3000/callback.
   - Give me a "Connect to QuickBooks" page at http://localhost:3000 that starts the sign-in, and handle the callback to store the access token and realm ID for the session.

3. The data:
   - Query open invoices using the QuickBooks Online v3 query endpoint (a query like: select from Invoice where Balance > '0', with pagination if needed).
   - For each open invoice, use its due date and balance to compute aging.

4. The dashboard, at http://localhost:3000/dashboard:
   - Group open balances into aging buckets: Current (not yet due), 1–30 days overdue, 31–60, 61–90, and over 90.
   - Show the total for each bucket, a grand total outstanding, and a simple bar chart of the buckets (a small chart library or plain CSS bars is fine).
   - Below the chart, a table of the open invoices: customer name, invoice number, due date, days overdue, balance.
   - Clean, readable styling for a non-technical business owner.

5. Finish by telling me, step by step: where to paste my Client ID and Client Secret, how to start the app, and what I should see at each step.

Claude Code will create the project, install what it needs (with your permission), and then walk you through the finish line. The steps will look like this:

1. Open the .env file it created (it's in your ar-dashboard folder — Claude Code can open it for you if you ask) and paste in your Client ID and Client Secret from the Intuit tab you kept open.
2. Start the app the way Claude Code tells you (usually npm start or node server.js).
3. Open http://localhost:3000 in your browser. localhost means "this computer" — the app is running privately on your machine, not on the internet.
4. Click Connect to QuickBooks, sign in with your Intuit developer account, and choose your sandbox company when asked.
5. Land on your dashboard.

And there it is: the sandbox company's unpaid invoices, sorted into aging buckets, with totals and a chart — live data, flowing from QuickBooks' computers, through the API, into an app that you built.

Graduating to your real books — later, and carefully

At some point you'll want this dashboard pointed at your real QuickBooks company. That's a reasonable goal, and here's the honest, unhurried path:

• Use a separate production app. In Intuit's developer dashboard, production access (real-company data) uses separate production keys with their own approval steps — you don't just flip a switch on your sandbox app. That separation is a feature: your experiments and your real connection stay isolated.
• Start read-only, stay read-only for a long time. A dashboard that only reads data can show you something wrong at worst — it can't damage anything. Writing data (creating invoices, editing customers) is a different level of responsibility. Most owners get years of value from read-only tools alone.
• Involve your accountant before ever writing data. If you eventually want a tool that changes your books, bring your accountant or bookkeeper into the conversation first. They know what a mistake costs to unwind, and they'll help you decide what safeguards you need.

None of this is meant to scare you — thousands of businesses run on tools exactly like the one you just built. It's meant to give you the same habits careful professionals have: sandbox first, read-only by default, real stakes only with real review.