{"id":4581,"library":"intuit-oauth","title":"Intuit OAuth Client","description":"The `intuit-oauth` library is the official Python client for working with Intuit APIs, providing OAuth 2.0 and OpenID Connect implementation. It simplifies authorization, token management, and API calls for services like QuickBooks Accounting, Payments, and UserInfo. The current version is 1.2.6, with active development and regular releases addressing new features, bug fixes, and security updates.","status":"active","version":"1.2.6","language":"python","source_language":"en","source_url":"https://github.com/intuit/oauth-pythonclient","tags":["oauth","intuit","quickbooks","accounting","payments","api-client","openid"],"install":[{"cmd":"pip install intuit-oauth","lang":"bash","label":"Install stable version"}],"dependencies":[{"reason":"Replaced 'python-jose' for better maintenance and security in v1.2.6. [from release notes]","package":"pyjwt","optional":false}],"imports":[{"symbol":"AuthClient","correct":"from intuitlib.client import AuthClient"},{"symbol":"Scopes","correct":"from intuitlib.enums import Scopes"}],"quickstart":{"code":"import os\nfrom intuitlib.client import AuthClient\nfrom intuitlib.enums import Scopes\n\n# Replace with your actual credentials from Intuit Developer Portal\nclient_id = os.environ.get('INTUIT_CLIENT_ID', 'YOUR_CLIENT_ID')\nclient_secret = os.environ.get('INTUIT_CLIENT_SECRET', 'YOUR_CLIENT_SECRET')\nredirect_uri = os.environ.get('INTUIT_REDIRECT_URI', 'https://example.com/callback')\nenvironment = os.environ.get('INTUIT_ENVIRONMENT', 'sandbox') # 'sandbox' or 'production'\n\nauth_client = AuthClient(\n    client_id,\n    client_secret,\n    redirect_uri,\n    environment\n)\n\n# Generate authorization URL\n# Scopes determine the level of access requested\nscopes = [Scopes.Accounting, Scopes.OpenId, Scopes.Profile, Scopes.Email]\nauthorization_url = auth_client.get_authorization_url(scopes)\n\nprint(f\"Please visit this URL to authorize your app: {authorization_url}\")\n\n# In a real application, you would redirect the user to this URL.\n# After authorization, Intuit redirects to your `redirect_uri` with `state`, `code`, and `realmId`.\n# You would then exchange the authorization code for tokens.\n# For example, after getting `auth_code` and `realm_id` from the callback URL:\n# try:\n#     auth_client.get_bearer_token(auth_code, realm_id=realm_id)\n#     print(f\"Access Token: {auth_client.access_token}\")\n#     print(f\"Refresh Token: {auth_client.refresh_token}\")\n# except Exception as e:\n#     print(f\"Error getting tokens: {e}\")","lang":"python","description":"This quickstart demonstrates how to instantiate the `AuthClient` and generate an authorization URL for the user to grant permissions. It highlights the use of `Scopes` and the necessary credentials. In a complete application, the authorization code obtained from the redirect would then be used to fetch bearer and refresh tokens."},"warnings":[{"fix":"Upgrade to version 1.2.6 or later.","message":"Version 1.2.6 replaced the `python-jose` dependency with `pyjwt` to address CVE-2024-23342. While this is primarily an internal change, direct reliance on `python-jose` features through the library might be affected. [from release notes]","severity":"breaking","affected_versions":"<1.2.6"},{"fix":"Ensure you are using `intuit-oauth` version 1.2.5 or higher for Python 3.12 environments.","message":"Python 3.12 support was explicitly added in version 1.2.5. Users running Python 3.12 with older versions of `intuit-oauth` may encounter compatibility issues. [from release notes]","severity":"gotcha","affected_versions":"<1.2.5"},{"fix":"Always persist the latest `access_token` and `refresh_token` received after any token exchange or refresh operation.","message":"OAuth 2.0 access tokens are valid for 1 hour (3600 seconds) and refresh tokens change with every refresh and are valid for 100 days of continuous use. It is critical to store and use the latest `refresh_token` value from each server response. Failure to do so will result in `invalid_grant` errors and require user re-authorization.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Configure your production `redirect_uri` to use HTTPS in both your Intuit Developer app settings and your application code.","message":"Redirect URIs used for production applications must be secured with HTTPS. HTTP redirect URIs are generally only permitted for local development (e.g., `http://localhost:port`) when using sandbox credentials.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Always verify that you are using the correct Client ID and Client Secret for your intended environment (sandbox or production).","message":"Intuit uses separate Client ID and Client Secret credentials for 'development' (sandbox) and 'production' environments. Using the wrong set of credentials for your target environment is a common mistake and will lead to authorization failures.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'1.2.6':46 '2.0':21 'account':38,64 'activ':48 'address':53 'api':18,32,67 'api-cli':66 'author':28 'bug':56 'call':33 'client':3,13,68 'connect':24 'current':43 'develop':49 'featur':55 'fix':57 'implement':25 'intuit':1,6,17,62 'intuit-oauth':5 'librari':8 'like':36 'manag':30 'new':54 'oauth':2,7,20,61 'offici':11 'openid':23,69 'payment':39,65 'provid':19 'python':12 'quickbook':37,63 'regular':51 'releas':52 'secur':59 'servic':35 'simplifi':27 'token':29 'updat':60 'userinfo':41 'version':44 'work':15","created_at":"2026-04-12T13:58:46.430091+00:00","updated_at":"2026-04-16T15:46:30.553627+00:00","problems":[{"fix":"Ensure you are always storing and using the *latest* refresh_token returned by the token endpoint after each successful refresh operation. If exchanging an authorization code, ensure it is used only once and before it expires. If the user has explicitly disconnected the app, they must reauthorize.","cause":"The authorization code is expired or has been used, or the refresh token is expired, revoked, or a new rotated refresh token was not persisted by the application. Intuit often rotates refresh tokens, making old ones invalid.","error":"{\"error\": \"invalid_grant\", \"error_description\": \"Token has been expired or revoked.\"}"},{"fix":"Implement robust logic to refresh the access token using the stored refresh token when a 401 error is encountered. If token refreshing also fails (e.g., with 'invalid_grant'), the user needs to re-authorize your application. Verify that the correct realm_id is used and that your app's scopes are properly configured and granted.","cause":"The access token used for an API call has expired (access tokens are typically valid for 1 hour), the user has revoked access to your application, or there is an issue with the realm_id or requested scopes.","error":"401 Unauthorized (or error code 003100/003200 'ApplicationAuthenticationFailed')"},{"fix":"Verify your client_id and client_secret against your Intuit Developer account. Ensure they are correctly base64 encoded as 'client_id:client_secret' and included in the 'Authorization: Basic' header of your token exchange requests, or passed as form parameters if your client implementation requires it.","cause":"Client authentication failed, typically due to an incorrect client_id or client_secret in your application's configuration, or because they are not being passed correctly (e.g., missing the 'Authorization: Basic' header, or incorrect base64 encoding).","error":"{\"error\":\"invalid_client\"}"},{"fix":"Navigate to your app's 'Keys & OAuth' tab in the Intuit Developer portal and ensure the redirect_uri in your code precisely matches one of the URIs listed there, including the scheme (http/https), host, port (if applicable), and path. Any mismatch, however minor, will cause this error.","cause":"The redirect_uri provided in your authorization request does not precisely match one of the Redirect URIs configured in your application settings on the Intuit Developer portal.","error":"The redirect_uri query parameter value is invalid. Make sure it is listed in the Redirect URIs section on your app's keys tab and matches it exactly."},{"fix":"Install the library using `pip install intuit-oauth`. If already installed, ensure you are running your script with the correct Python interpreter (e.g., activate your virtual environment if you are using one, or explicitly use `python3 -m pip install intuit-oauth` and `python3 your_script.py`).","cause":"The 'intuit-oauth' Python package, which contains the 'intuitlib' module, is not installed in the Python environment currently being used to run your code, or there is a mismatch between the environment where it was installed and where the code is executed.","error":"ModuleNotFoundError: No module named 'intuitlib'"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.2.7","cli_name":"","cli_version":null,"type":"library","homepage":"https://developer.intuit.com","github":"https://github.com/intuit/oauth-pythonclient","docs":null,"changelog":null,"pypi":"https://pypi.org/project/intuit-oauth/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","crm-productivity","payments","http-networking"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-30","next_check":"2026-07-28","install_tag":null}}