Best Of

1) In order to connect to a data file on the Hosted platform via the API it is necessary to authorise with the Identity server.

Authentication - Hosted API - Reckon Help and Support Centre

Then when connecting to a specific data file you can provide the UserName and the Password for the integrated application that you are developing.

Authentication - Hosted API - Reckon Help and Support Centre

APIs: Details - Reckon Developer Portal

2) Is the redirect URI oauth.pstmn.io the same one that you provided when you put through your Developer Partner application that is associated with your ClientID and ClientSecret?

Check the email that you would have originally received when that confirms your ClienID, ClientSecret and RedirectURI.

3) Did you submit the question via the web ticket or did you email directly?

If you used the web ticket, did you indicate that you require assistance with "Reckon API" as the product?

If you emailed directly, then you would have received the automated response email that states:

Dear Customer, 

Thank you for reaching out.

Please note that as of August 3, 2025, we are no longer accepting direct emails for support. Instead, you will need to lodge a web ticket. Lodging a web ticket ensures faster responses, organised tracking of your inquiry, and access to dedicated support resources tailored to your needs.

Yes, Reckon Hosted is essentially Reckon Desktop running in the cloud.
The Reckon Hosted API is mainly a transport layer that allows you to send and receive Reckon Desktop SDK/XML requests and responses through their servers.
That means you still need to understand how Reckon Desktop SDK/XML structure works (for example, how to build <QBXML> requests and parse the corresponding <QBXML> responses).

So while the Hosted API lets you automate communication remotely, the underlying logic and data formats remain the same as Reckon Desktop.

Hi @mattmartin

The Reckon API uses OAuth2 Authorization Code Flow, so it follows the same process as other modern APIs that use secure token-based access. Below are the steps and relevant API calls you’ll need to handle in your pipeline setup:

Step 1. User Authorization (one-time only)

You must first obtain an authorization code by redirecting the user to Reckon’s identity server:

GET https://identity.reckon.com/connect/authorize?
response_type=code
&client_id={YOUR_CLIENT_ID}
&scope=open read write offline_access
&redirect_uri={YOUR_REDIRECT_URI}
&state=random_state

• The user logs in and grants permission to your app.

https://your-redirect-uri?code={AUTHORIZATION_CODE}&state=random_state

• Step 2. Exchange Authorization Code for Tokens

Use the code you received to get the Access Token and Refresh Token:

POST https://identity.reckon.com/connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code={AUTHORIZATION_CODE}
&redirect_uri={YOUR_REDIRECT_URI}
&client_id={YOUR_CLIENT_ID}
&client_secret={YOUR_CLIENT_SECRET}

You’ll store both the access_token and refresh_token.
The access token is used to call Reckon APIs, while the refresh token lets you renew access later without user interaction.

Step 3. Use Access Token to Call the API

Now you can call any Reckon API endpoint by including the Authorization header:

Step 4. Refresh the Access Token (for automation)

When your access token expires (typically after 6 hour), use the refresh token to get a new one automatically, this is what you’ll implement in your Azure Fabric Pipeline:

You can now continue your ingestion process automatically, without any manual login.

In Summary

• The first login is manual (user grants permission).
• After that, Azure Fabric Pipelines can automatically:
  • Store and use the refresh_token
  • Periodically request a new access_token
  • Continue calling Reckon’s API without further prompts

I don’t work for Reckon directly, but these are the correct steps based on their OAuth2 implementation. The most common issue that causes “unexpected error” is a mismatch between your registered redirect URI and the one used in Postman. Make sure they are identical (including protocol and trailing slash).

Thanks,

Phuong