How to Connect QuickBooks Online to ChatGPT and Claude: The Complete MCP Setup Guide

"Connect QuickBooks Online to ChatGPT" sounds like one thing. It's actually four different things wearing the same name, and only some of them let the AI change anything in your books.

Some people want to ask ChatGPT a question about their cash flow. Some want Claude to read a client's P&L and flag what looks off. Some want the AI to actually fix a miscategorized transaction, post a journal entry, or match a deposit. Those are very different jobs, and they need very different setups. Pick the wrong one and you either can't do what you came to do, or you hand a chatbot delete access to your live financials.

This guide walks through all four paths, in plain terms, with a full step-by-step for the one most people mean when they say "connect it properly": the official QuickBooks Online MCP server, the developer route that gives an AI real read-and-write access. We'll cover the developer account, the sandbox, getting production approved, the realm ID and refresh token, and how to do the whole thing without leaving your books wide open. Then we'll be honest about the part most tutorials skip: getting the AI connected is the easy 20%. Getting it to do the books correctly is the hard 80%.

How do you connect QuickBooks Online to ChatGPT or Claude?

There are four ways. The official QuickBooks app inside ChatGPT (live since late 2025) gives read-only insights like profit-and-loss and cash-flow summaries, but can't change your books. The official Intuit QuickBooks Online MCP server is an open-source local program with 144 tools that gives an AI assistant full read-and-write access over the Model Context Protocol, but it needs a developer account, OAuth 2.0 credentials, and a local subprocess, so it's built for developers. Hosted MCP servers skip the setup by running in the cloud, but you hand a third party write access to your books. Purpose-built platforms connect once by OAuth and add accounting logic on top. Every route that can write to your books requires an Intuit Developer app and OAuth. There is no per-user API key.

Key Takeaways

• Four paths, not one. The ChatGPT QuickBooks app (read-only insights), the official Intuit MCP server (full read-write, developer setup), hosted MCP servers (full read-write, third-party trust), and purpose-built accounting platforms. Match the path to whether you need the AI to read or to change your books.
• A local MCP server can't reach web ChatGPT. ChatGPT and Claude in a browser can't talk to a program running on your laptop. Local servers work with Claude Desktop, Cursor, and similar apps. For web AI you need a hosted server.
• The write route always needs a developer account. You register an app on the Intuit Developer Portal, complete a one-time OAuth handshake, and store a client ID, client secret, refresh token, and realm ID. Intuit does not hand out simple API keys.
• Production is harder than sandbox. Sandbox accepts a localhost callback. Production rejects it and requires a public HTTPS URL, usually solved with an ngrok tunnel for the one-time handshake.
• Security is on you. The official server ships 144 tools, including ones that delete invoices, customers, and journal entries. Start read-only, sandbox first, and never commit your credentials.
• Connecting is the easy part. A general AI with raw write access will still miscategorize a Stripe deposit and misread a transfer. It has no memory of your corrections and no audit trail. The connection is a pipe, not a bookkeeper.

The four ways to connect QuickBooks Online to an AI

Before you install anything, get clear on which of these four you actually need. The fastest way to waste an afternoon is to set up a full developer integration when the free app in ChatGPT already answers your question, or to expect the free app to fix a transaction it was never built to touch.

Here's the whole landscape in one table. Read the "writes and adjusts" and "accounting judgment" columns first, because that's where the real difference lives.

Two honest notes on that table.

First, "accounting judgment" is a real column, not marketing. A raw connection, official or hosted, gives the AI a set of buttons: create an invoice, categorize a transaction, post a journal entry. It does not give the AI any sense of whether the categorization is right. That judgment is the entire job of bookkeeping, and none of the raw connections carry it.

Second, the free ChatGPT app is genuinely useful and genuinely limited. It reads. It won't write. If your question is "how did my margins move this quarter," it's the fastest answer on the list. If your task is "fix the 14 transactions I categorized wrong," it can't help, and you're back to one of the write routes.

The rest of this guide focuses on the write routes, because that's the setup people find confusing, and it's the one with real security stakes.

Do you even need a write connection? A quick gut check

Before you spend the hour, it's worth ruling yourself in or out. Most people who search for this need less than they think.

Answer three questions:

1. Do you need the AI to change records, or just read them? If you only want answers, reports, and trends, you don't need any of the developer setup. The free ChatGPT app or a read-only local connection covers you, and you can stop after the sandbox step.
2. Is this your own company, or a client's? Your own books are your risk to take. A client's books carry confidentiality obligations and a much higher bar for getting it wrong. If it's client work, weigh a purpose-built accounting tool against a raw connection before you build anything.
3. How many companies? The official server connects to one company per configuration. One company is fine. A roster of twenty means twenty configurations to build and maintain, which is the point where the developer route stops scaling and a platform starts making sense.

If your honest answers are read-only, your own company, and one entity, the setup ahead is a fun weekend project. If they're write access, client books, and many companies, keep reading, but know that the walkthrough is the start of a maintenance job, not the end of a setup.

What the Model Context Protocol is, and why QuickBooks uses it

The three "connect and write" paths all run on the same underlying standard: the Model Context Protocol, or MCP.

MCP is an open standard introduced by Anthropic. It gives AI assistants a common way to reach outside tools and data. Instead of every app inventing its own plugin format, a service publishes an "MCP server" that exposes its features as callable tools. Any MCP-compatible client, Claude Desktop, Cursor, and a growing list of others, can then use those tools. Think of it as a universal adapter between an AI and the software you already run.

For QuickBooks, this matters because the alternative is ugly. Without a connection, using AI on your books means exporting a report, pasting it into a chat, reading the answer, and then typing the changes back into QuickBooks by hand. MCP removes the copy-paste. The AI reads real-time data and, if you allow it, acts on it directly.

Intuit published an official QuickBooks Online MCP server as an open-source preview in 2025. The numbers are worth knowing before you commit, because they tell you both how capable and how sharp this thing is:

• 144 tools. Full create, read, update, delete, and search across the QuickBooks API.
• 29 entity types. Invoices, bills, customers, vendors, journal entries, deposits, transfers, and more, each with its own set of tools.
• 11 financial reports. Balance Sheet, Profit and Loss, Cash Flow, Trial Balance, and others.
• OAuth 2.0 authentication. Token-based, the same security model banks use for third-party access.

That's broad coverage. It's worth seeing what it actually spans before you decide how much of it to switch on.

On the read side, the 29 entity types cover the whole ledger: customers and vendors, invoices and bills, payments and deposits, journal entries, transfers, items, accounts, classes, and more. Each entity has a matching set of tools, so search_invoices, get_invoice, create_invoice, update_invoice, and delete_invoice all exist as separate callable tools. The 11 reports include the ones you'd reach for first: Profit and Loss, Balance Sheet, Cash Flow, Trial Balance, plus aged receivables and payables. That read layer alone, with writes switched off, is already a capable analyst for your books.

The write side is where the count of 144 stops being a bragging point and starts being a warning. Among those tools are delete_invoice, delete_journal_entry, and delete_customer. This is not a read-only reporting layer. It's the full keyboard of your accounting system, handed to a model that will press keys when asked. We'll come back to that in the security section, because it changes how you should set it up.

One more expectation to set now. The official server is a local program. It runs on your machine as a subprocess and talks to your MCP client over your computer, not over the web. That single fact decides whether you can use it with the app you have, and it's the most common thing people get wrong. More on that after the walkthrough.

The 144 tools, grouped by area

To make the abstract concrete, here's roughly how the tools break down. You won't use all of them, but seeing the shape tells you what's possible and what to switch off.

Every area has read tools and write tools. The read tools (get_*, search_*, and the reports) are the safe majority. The write tools (create_*, update_*, delete_*) are the ones that carry risk, and the ones the disable flags switch off in bulk. When you start read-only, you keep this entire reference and reporting surface and give up only the ability to change anything, which is exactly the trade you want on day one.

Before you build anything: what the ChatGPT QuickBooks app already does

If you use ChatGPT, you may not need to build anything at all. In November 2025, Intuit and OpenAI announced a partnership, reportedly worth more than $100 million, that put Intuit's apps directly inside ChatGPT. The QuickBooks app is live for all logged-in ChatGPT Free, Plus, and Pro accounts in the US, on web and mobile.

Here's what it does. You connect your QuickBooks account once inside ChatGPT, and then you can ask about your business in plain language. It reads your data to analyze profitability, cash flow, and benchmark comparisons against similar businesses by industry and region. It can generate key reports like profit-and-loss and cash-flow statements. For an owner who wants to understand their numbers without opening QuickBooks, it's the shortest path there is, and it costs nothing beyond a ChatGPT account.

Here's what it doesn't do. It reads. It does not write. It won't recategorize a transaction, post an adjusting entry, match a deposit to invoices, or clean up a messy month. It's an insights window onto your books, not a set of hands inside them. Ask it to fix something and you'll get an explanation of what to do, not the fix itself.

So the honest test is simple:

Should you use the ChatGPT app or build an MCP connection?

Use the free QuickBooks app in ChatGPT if your goal is to understand your numbers: reports, trends, cash-flow questions, quick benchmarks. Build (or adopt) an MCP connection if your goal is to change your books: categorization, adjustments, entries, cleanup. The app answers questions. The MCP route does work.

For the rest of this guide, assume you're in the second camp. You want the AI to do work, not just describe it. That means the official MCP server, so let's build it.

The full walkthrough: connect QuickBooks Online to Claude with the official MCP server

This is the detailed path. We'll use Claude Desktop as the example client because it's the most common local MCP client, but the same server works with Cursor and other MCP-compatible desktop apps. Budget an hour for your first run. Most of that hour is the developer account and the OAuth handshake, both of which are one-time.

We'll go sandbox first, then production, because that's both the safe order and the order the tooling wants.

What you'll need before you start

• Node.js and npm installed on your machine. The server is a TypeScript project you build locally.
• Git, to clone the repository.
• A local MCP client, such as Claude Desktop or Cursor. Remember: this server is local, so a web-only AI won't reach it.
• A QuickBooks Online company for production, or nothing extra for sandbox (the developer portal gives you a free sandbox company).
• About an hour, mostly for the one-time account and OAuth steps.

Step 1: Create a developer account and register an app

Everything starts at the Intuit Developer Portal. This is non-negotiable. Even if you only want to read your own company's data, Intuit does not offer per-user API keys. There is no shortcut around creating an app.

1. Go to the Intuit Developer Portal and create a new app.
2. Open the app, then in the left sidebar go to Settings, then Redirect URIs, and add http://localhost:8000/callback.
3. Open the app's Keys & Credentials page and copy your Client ID and Client Secret from the Development keys.

Keep that Client ID and Client Secret somewhere safe for a few minutes. They're the first two of the four values you'll need. Treat the secret like a password, because it is one.

Step 2: Install and build the server

Clone the repository and build it. In your terminal:

1# Clone the repository
2git clone https://github.com/intuit/quickbooks-online-mcp-server.git
3cd quickbooks-online-mcp-server
4
5# Install dependencies
6npm install
7
8# Build the project
9npm run build
Copy

That compiles the TypeScript into a runnable server under dist/. You'll point your MCP client at that compiled file later.

Step 3: Configure your credentials and run the sandbox handshake

The server reads its credentials from a .env file in the project root. Copy the template and fill in your values:

1cp .env.example .env
Copy

Your .env will look like this:

1QUICKBOOKS_CLIENT_ID=your_client_id
2QUICKBOOKS_CLIENT_SECRET=your_client_secret
3QUICKBOOKS_ENVIRONMENT=sandbox
4QUICKBOOKS_REFRESH_TOKEN=your_refresh_token
5QUICKBOOKS_REALM_ID=your_realm_id
Copy

You already have the Client ID and Client Secret from Step 1. Set QUICKBOOKS_ENVIRONMENT=sandbox. You'll fill in the refresh token and realm ID from the handshake you're about to run.

In the developer portal, create or select a sandbox company under the Sandbox menu. Sandbox is a fake company with fake data. It exists so you can break things safely, and you should use it for your entire first run.

Now complete the OAuth handshake:

1npm run auth
Copy

Your browser opens, you sign in to the sandbox company, and you approve the connection. The server captures the tokens and saves them to your .env. This is where the refresh token and realm ID come from. You don't type them by hand; the handshake writes them for you.

The sandbox works with a localhost redirect URI, which is why it's easy. Production is where the friction starts.

A quick sandbox testing playbook

Before you touch a real company, spend twenty minutes proving the workflow in sandbox. It's the cheapest insurance you'll ever buy on a financial integration.

Run these three checks in order:

1. Prove the read path. Ask the AI to pull company info and a Profit and Loss. If numbers come back, the connection, tokens, and realm ID are all correct. If they don't, the problem is setup, not your prompts, and you fix it here where nothing is real.
2. Prove a single safe write. With write tools on in sandbox only, ask it to create one test invoice for a fake customer, then read it back. This confirms the write path works and shows you exactly how the model phrases a change before you ever approve one on a real company.
3. Prove your guardrails. Turn the disable-delete flag on, then ask the AI to delete that test invoice. It should report that it can't, because the tool no longer exists. That's you confirming the safety switch actually works, not just trusting that it does.

Only after all three pass should you point the same workflow at a production company. And when you do, flip the write flags back off first. Production earns trust one loosened flag at a time.

Step 4: Get production approved (the redirect URI problem, and the two fixes)

When you're ready to connect a real company, you switch to production keys and set QUICKBOOKS_ENVIRONMENT=production. Here's the wall almost everyone hits, in a table:

The Intuit Developer Portal rejects http://localhost redirect URIs in production mode. Every developer who tries this hits it. The reason is that the one-time authorization handshake has to send you back to a real, public, HTTPS callback address, and localhost isn't public.

There are two known ways around it.

Fix 1: an ngrok tunnel (most common). ngrok gives your local machine a temporary public HTTPS address. Run it against the port your callback listens on:

1ngrok http 8000
Copy

ngrok prints a public URL like https://<id>.ngrok-free.app. In your Intuit app, go to Settings, then Redirect URIs, and add https://<id>.ngrok-free.app/callback. Use that URL for the one-time production OAuth handshake. Once you've captured the refresh token, you can revert to localhost, because you won't need the public URL for daily use.

Fix 2: a small public callback handler. If you can't use ngrok, deploy a tiny public callback handler, for example a serverless function or a small VPS endpoint, that captures the authorization code and hands it back to your local setup. This is more involved and only worth it if a tunnel isn't an option.

The important thing to understand about production: this public-URL dance is a one-time cost. After the handshake completes, the refresh token in your .env is what keeps you connected. You no longer need the public redirect URL for day-to-day use. That's why the setup feels harder than it looks in the end. You climb a wall once, then it's gone.

Step 5: Understand your realm ID and refresh token

Two of your four credentials are worth understanding, not just pasting, because they're the ones that confuse people and the ones that carry the real access.

The realm ID is your QuickBooks company ID. Every QuickBooks Online company has one. When you complete the OAuth handshake against a specific company, the realm ID that gets written to your .env is that company's ID. If you manage several companies, each has its own realm ID, and the server connects to one company per configuration. This is the single-company limit worth planning around if you're a bookkeeper with a roster of clients.

The refresh token is the credential that matters most. After the handshake, it's the key that keeps the server connected without sending you back to the browser every time. It auto-rotates: each time the server refreshes access, it receives a new refresh token and rewrites your .env with it. That rotation is a security feature, but it has a practical consequence. The process needs permission to write to that .env file, and if you copy the token somewhere else, your copy goes stale the next time it rotates. Let the server manage it. Don't hard-code it into three places.

Once you have all four values, your .env for a real company looks like this:

1QUICKBOOKS_CLIENT_ID=your_client_id
2QUICKBOOKS_CLIENT_SECRET=your_client_secret
3QUICKBOOKS_REFRESH_TOKEN=your_refresh_token
4QUICKBOOKS_REALM_ID=your_realm_id
5QUICKBOOKS_ENVIRONMENT=production
Copy

Step 6: Wire the server into your MCP client

Now connect the built server to your AI client. In Claude Desktop, this means editing the MCP servers section of your config file. The pattern looks like this:

1{
2  "mcpServers": {
3    "quickbooks": {
4      "command": "node",
5      "args": ["path/to/quickbooks-online-mcp-server/dist/index.js"],
6      "env": {
7        "QUICKBOOKS_CLIENT_ID": "your_client_id",
8        "QUICKBOOKS_CLIENT_SECRET": "your_client_secret",
9        "QUICKBOOKS_REFRESH_TOKEN": "your_refresh_token",
10        "QUICKBOOKS_REALM_ID": "your_realm_id",
11        "QUICKBOOKS_ENVIRONMENT": "sandbox",
12        "QUICKBOOKS_DISABLE_WRITE": "false",
13        "QUICKBOOKS_DISABLE_UPDATE": "false",
14        "QUICKBOOKS_DISABLE_DELETE": "false"
15      }
16    }
17  }
18}
Copy

Notice the last three lines. QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE, and QUICKBOOKS_DISABLE_DELETE let you switch off whole categories of tools. Set them to true and the matching tools never register, so the AI simply cannot see them. For your first real connection, the safe move is to set all three to true and start read-only. You can loosen them later, one at a time, once you trust what the model does. We'll say more on this in the next section.

Restart your MCP client after editing the config so it picks up the new server.

Step 7: Verify it works

Start with the safest possible prompt, something that reads and changes nothing:

Using the QuickBooks tools, get my company info and show me this year's profit and loss.

If the server is wired correctly, the AI calls get_company_info and get_profit_and_loss and reports back real numbers. That's your green light. Only after a clean read should you consider enabling any write tools, and even then, sandbox first.

Common pitfalls

Two problems account for most first-run failures:

• The .env is loaded from the wrong directory. The server resolves .env relative to its compiled module, not your shell's current folder. When you launch it through Claude Desktop, this bites people. Make sure you're on the current main branch and that the file sits where the server expects it.
• Redirect URI mismatch. The URI you register in the Intuit portal must match the one the server uses exactly: protocol, host, port, and path. http://localhost:8000/callback is not the same as http://localhost:8000/callback/ or a different port. One character off and the handshake fails.

Troubleshooting: common errors and what they mean

When a connection misbehaves, the error usually points straight at the cause. The common ones:

• 401 Unauthorized or invalid_grant. Your token is bad or expired. Re-run the OAuth handshake to get a fresh one. If it keeps happening, check that the Client ID and Secret in .env match the app you authorized against: sandbox keys for sandbox, production keys for production.
• Empty results when data clearly exists. Almost always a wrong environment or wrong realm ID. A sandbox connection reads the sandbox company, which is empty of your real data. Confirm QUICKBOOKS_ENVIRONMENT and that the realm ID belongs to the company you mean.
• redirect_uri mismatch during the handshake. The URI in your Intuit app doesn't match the one the server used, exactly. Recheck protocol, host, port, and path. In production, confirm the ngrok URL is the one registered and that ngrok is still running.
• The server starts but the AI sees no QuickBooks tools. Usually the client config: a wrong path to dist/index.js, or the client wasn't restarted after you edited the config. Fix the path, restart the client.
• It worked yesterday, broken today. Suspect the refresh token. If the .env couldn't be written on the last rotation, the saved token is stale. Check the file's permissions and location, then re-authorize if needed.

Change one thing at a time when you debug. Flip a single variable, test, and see if it moved. Changing three things at once just hides which one mattered.

What you can actually do once it's connected

Once the server is wired in and reading cleanly, the natural question is what to ask it. The connection is most useful for three kinds of work, and it's worth being deliberate about which kind you're doing, because the risk climbs sharply from the first to the third.

Read and explain. This is the safest and, for most people, the most valuable use. You keep every write flag off and treat the AI as an analyst who can see your live books.

Compare this quarter's operating expenses to last quarter and tell me the three categories that moved most, with the dollar and percent change for each.

Look at my accounts receivable aging and list every customer more than 60 days past due, sorted by amount.

Walk through my Profit and Loss for the year and point out anything that looks unusual for a business my size.

Nothing here changes a record. The AI reads, you learn, and the worst case is a wrong answer you catch, not a wrong entry you have to reverse.

Draft and prepare. A step up in usefulness, still no write access. The AI reads your books and produces something you act on elsewhere.

Based on my unpaid invoices, draft a short, friendly payment-reminder email for each customer over 30 days late. Use a placeholder for the name.

Read my expense categories and build me a checklist of the accounts I should double-check before I close the month.

The output is a draft. You review it, then you do the actual work in your own tools. This keeps the AI's judgment out of your ledger while still saving you the blank-page time.

Change the books. The powerful, risky one. Write tools on, the AI creating or editing records directly. This is where everything from the security section applies at once. Do it in sandbox first, keep delete off, enable one capability at a time, and approve every change.

Here are five transactions and the category each should go to. Create the categorization for each, show me what you're about to do, and wait for my confirmation before posting.

Notice the shape of that last prompt. It asks the model to propose and wait, not to act. That pattern, propose then confirm, is the single most important habit for write-enabled prompts. The AI is fast. Your review is what keeps fast from turning into wrong.

Connecting to ChatGPT specifically, and the local-vs-hosted wall

Everything above assumes a local MCP client like Claude Desktop. If you want to connect QuickBooks Online to ChatGPT instead, or to Claude in a browser, there's a hard limit you need to know before you spend the hour.

A web-based AI cannot reach a program running on your laptop. ChatGPT on the web and Claude on the web run in the cloud. The official Intuit server runs as a subprocess on your machine. There is no path between them. So the local server works with desktop MCP clients and does not work with web ChatGPT, full stop.

That leaves two options if ChatGPT is where you want to work.

Option A: the free QuickBooks app in ChatGPT. Covered above. Read-only insights, zero setup, but no ability to change your books.

Option B: a hosted MCP server. A hosted server runs the same kind of MCP interface, but in the cloud at a public URL. You paste that URL into your AI client once, sign in with OAuth, and you're connected. No developer account, no local subprocess, no ngrok. Several providers offer this for QuickBooks, including general integration platforms and dedicated hosts. They work with web clients precisely because they live in the cloud too.

Hosted options come in a few flavors. General integration platforms connect AI to hundreds of apps, QuickBooks among them, and are handy if you already use one for other automations. Dedicated QuickBooks hosts focus on this one connection and tend to be the quickest to stand up. Either way, the trade is the same: you save the setup, and in exchange your books' write access now runs through someone else's servers. Read their data-handling terms the way you'd read a bank's, because for this purpose that's what they are.

Hosted servers solve the reach problem, but they add two costs you should weigh honestly:

• You hand a third party write access to your live books. With the local official server, your credentials sit on your machine. With a hosted server, that trust extends to whoever runs the host. For your own bookkeeping that may be fine. For client books, it's a data-handling decision you should make on purpose, not by default.
• They're still generic. A hosted server is the same set of raw buttons as the local one. It's faster to connect. It's no smarter about your books. Everything in the next section still applies.

Claude, ChatGPT, or Cursor: which AI client for QuickBooks

The MCP server is the same regardless of which AI you point at it, but the client you choose changes what's possible. Here's the short version.

Claude Desktop is the most common home for the local official server. It's a desktop app, so it can reach a program running on your machine, and it speaks MCP natively. If you're following the walkthrough above, this is the default choice, and the one most setup guides assume.

Cursor and other developer-focused desktop tools also support MCP and work with the same local server. If you already live in Cursor, you can add the QuickBooks server there and skip a second app.

ChatGPT and Claude on the web cannot reach a local server, as covered earlier. For web ChatGPT specifically, your realistic options are the free official QuickBooks app for read-only insights, or a hosted MCP server for write access. There is no way to make web ChatGPT talk to the local Intuit server on your laptop.

The practical takeaway: if you want full read-and-write control and you're comfortable with a desktop app, use Claude Desktop with the local official server. If you're set on working inside web ChatGPT, accept that you're choosing between read-only insights and trusting a hosted third party with write access. The client isn't a detail. It decides which of the four paths is even available to you.

Doing it securely: the part most guides skip

There's one word worth underlining before you build any of this: securely. This is where a "cool AI setup" quietly becomes a liability. You are about to give a language model a login to your financial records. Here's how to do that without regretting it.

Start read-only, always. The server ships 144 tools, and some of them delete things: invoices, journal entries, customers, deposits. A model that misreads a prompt and calls delete_invoice on a live company has done real damage that someone has to unwind. Use the QUICKBOOKS_DISABLE_WRITE, QUICKBOOKS_DISABLE_UPDATE, and QUICKBOOKS_DISABLE_DELETE flags. Set all three to true on day one. The AI can read everything and change nothing. Loosen one flag at a time, only after you've watched it behave.

Sandbox before production, every time. Test every new prompt or workflow against the sandbox company first. Sandbox data is fake, so a wrong move costs nothing. Only graduate a workflow to production after it's been clean in sandbox. This one habit prevents most disasters.

Treat your credentials like bank keys, because they are. The Client Secret and refresh token together are full access to your financials. Three rules follow. Never commit your .env to git; the repository already gitignores it, and you should confirm that stays true. Never paste credentials into a chat window, including the AI you're setting up. And on a shared machine, remember that the env block in your MCP client's config file is plain text on disk. Anyone who can read that file can read your tokens. A secret manager is worth it if more than one person uses the computer.

Keep a human in the loop for writes. The point of read-only-first is that you stay the one who approves changes. Even once you enable write tools, don't let the model post entries unattended. Have it propose, you approve. An AI that categorizes 200 transactions in a burst is fast. An AI that categorizes 200 transactions wrong in a burst is a cleanup project.

Mind the client-data line. If you're a bookkeeper or accountant, these aren't your books; they're your client's. Putting client financials through a general-purpose AI raises confidentiality and engagement questions that a hobbyist connecting their own company never faces. Know your data-handling obligations before you connect a client's realm, and never put a client's name next to a real number in a raw chat window. This isn't legal advice; it's a flag to check your own rules.

Understand the audit-trail gap. When the official server posts a change, QuickBooks records that a change happened. What it doesn't record is why, or that an AI made the call, or what the model was reasoning from. For personal books, fine. For anything that might get reviewed, examined, or audited, a raw MCP connection leaves you explaining changes you didn't personally make and can't fully reconstruct. That gap is small until the day it isn't.

Think in terms of blast radius. Before you enable any write tool, ask what the worst single action could do. Read-only has a blast radius of zero: a bad answer, nothing changed. Create and update can post wrong records that take time to find and fix. Delete can remove records that other records depend on, and QuickBooks doesn't always make that easy to undo. Match the access to the blast radius you can live with. For most people, most of the time, that means delete stays off permanently, and write stays off until a specific task needs it.

None of this is meant to scare you off. It's meant to make the setup boring, which is exactly what you want a financial integration to be. Read-only, sandbox-first, credentials locked down, human approving writes. Do that and the security story is genuinely fine.

What this actually costs: time, money, and upkeep

The official server is free and open-source, so it's easy to assume the whole thing is free. The software is. The setup and the upkeep are not.

Time. Your first connection runs about an hour: the developer account, the build, the sandbox handshake, and the production workaround. That's a one-time cost per company. The catch is per company. If you keep books for fifteen clients, that's fifteen developer setups, fifteen production handshakes, and fifteen .env files to manage.

Money. The server itself costs nothing. Your AI client may not: Claude Desktop and ChatGPT have free tiers, but heavy use pushes you into paid plans. Hosted MCP servers typically charge a monthly or per-seat fee in exchange for skipping the setup. So the "free" route has a time cost, and the "easy" route has a money cost. There's no version that's free and zero-effort at once.

Upkeep. This is the line item people forget. Refresh tokens rotate, and the server rewrites your .env; if that file's permissions or location break, the connection dies quietly. The library gets updates, and a stale checkout hits bugs that current main has already fixed. A production company you connected months ago can stop working after a token issue you then have to diagnose. A single connection is low-maintenance. A dozen connections is a small ongoing job.

None of this makes the developer route wrong. It makes it a build, with the ownership a build implies. Go in knowing that, and it won't surprise you later.

The catch nobody mentions: it can write, but it can't do the books

Here's the part the setup tutorials leave out, and it's the most important part.

Getting the AI connected is the easy 20%. You've now seen the whole thing: an account, a build, a handshake, a config file. It's fiddly, but it's finite. Once it's done, you have a language model that can read and write your QuickBooks.

Doing the books correctly is the hard 80%, and the connection does nothing for it.

A general AI with raw write access to QuickBooks has buttons but no judgment. It will confidently do the wrong thing, in exactly the places bookkeeping is actually hard:

• The Stripe deposit. A $3,847.92 Stripe payout is not $3,847.92 of revenue. Stripe took its fees out first. Posted gross, your income is overstated and your fees are missing. A general model reads the deposit amount and books it. It doesn't know to net it, because netting is an accounting decision, not a data lookup.
• The transfer that looks like income. An owner draw, a loan, and a transfer between accounts can all look identical in a bank feed: money moving, no helpful label. Categorize a transfer as income and you've inflated revenue and created a tax problem. The right move is to flag it for a human, not guess. A general model guesses.
• The transaction with no description. "ACH PAYMENT 847293847" tells the model nothing. A real bookkeeper reads the date, the amount, the recurring pattern, the bank code, and often still asks the client. A general model pattern-matches on thin air and picks something.

QuickBooks' own auto-categorization, which has years of tuning behind it, lands around 50% accurate on this work in many bookkeepers' experience. Bookkeepers have a name for that: optimistically random. A general LLM does a bit better on clean transactions and no better on the hard ones, because the hard ones aren't a language problem. They're a judgment problem.

And there's a memory gap on top of the judgment gap. Correct a general AI today and it forgets by tomorrow. Every session starts cold. Your client's "Amazon means office supplies, except the March charge that was a laptop" rule has to be re-explained every time, because a raw connection has no per-client memory. The corrections don't compound. You do the same teaching, forever.

So the raw MCP connection, official or hosted, is a pipe. A well-built pipe. But a pipe carries whatever you put in it, and what you're putting in is a model that doesn't know your books, doesn't remember your corrections, and doesn't understand why net is different from gross. For asking questions, that's fine. For doing the books, the connection is the beginning of the problem, not the end of it.

A simpler path: connect once, and put the routine on autopilot

If what you actually want is for an AI to keep your books, not just reach them, the four-path table has a fourth row for a reason. This is the honest pitch, and we'll keep it honest about what's shipped and what's coming.

Growthy is built for the job the raw connection can't do. Instead of a developer account, a local subprocess, an ngrok tunnel, and a refresh token you babysit, you connect QuickBooks Online once with a normal OAuth sign-in. That connection is live today in the alpha. No dist/index.js, no port 8000, no production-approval wall.

What the connection feeds into is the difference. Once connected, Growthy handles the routine categorization for you: 85% accurate on a first import. You review the rest. It doesn't try to hide what it can't do. It tells you what it isn't sure about, "13 of these 247 need you," instead of a wall of everything to re-check. The corrections you make carry forward per client, so it keeps getting sharper on that client's books as the weeks go on. And because it's built for accounting rather than general chat, the net-versus-gross Stripe deposit, the transfer that looks like income, and the no-description transaction get flagged for review instead of confidently booked wrong. You review and approve every categorization, so nothing is final that you didn't sign off on.

Here's the part we're building right now. The piece people picture when they imagine "just tell the AI to fix it," a conversational accounting director that makes the adjustments for you from a chat, is in active development and testing. We're not shipping it until it's genuinely reliable, because a chat agent that adjusts live books has to be right, not just fast. It releases after we exit beta. If that's the workflow you came here for, the fastest way to get it is to connect your books now and be in line when it lands.

If you just want the routine categorization off your plate, that's the alpha you can use today. If you want the conversational agent that makes the adjustments for you, get connected now so you're first when it ships.

See Growthy on your own books. Connect QuickBooks Online in a couple of clicks, put the routine categorization on autopilot, and be first in line for the accounting agent as it rolls out. Get started with Growthy.

For more on where AI genuinely helps in a bookkeeping workflow and where it doesn't, read our honest walkthrough of how to use Claude for bookkeeping, our comparison of Claude vs ChatGPT for bookkeeping, and our overview of AI bookkeeping. If your work is on the tax side, the same operator stack covers that through our sister product for tax workpaper automation, TracePrep.

Glossary: the terms in this guide

A few terms show up throughout. Here's each in one line.

• MCP (Model Context Protocol). An open standard from Anthropic that lets AI assistants use outside tools through a common interface. The thing that connects an AI to QuickBooks.
• MCP server. A program that exposes a service's features as tools an AI can call. The QuickBooks MCP server exposes 144 of them.
• OAuth 2.0. The token-based sign-in flow that grants the server access to your QuickBooks company without ever handling your QuickBooks password.
• Client ID and Client Secret. The credentials that identify your app to Intuit. You get them from your app's Keys and Credentials page. The secret is a password; guard it.
• Realm ID. Your QuickBooks company's unique ID. Each company has one. The server connects to one realm per configuration.
• Refresh token. The credential that keeps the server connected after the first handshake. It auto-rotates, and it's the most sensitive value you'll store.
• Redirect URI. The address Intuit sends you back to after you authorize. Localhost works in sandbox; production needs a public HTTPS URL.
• Sandbox. A free fake company for testing. Where every new workflow should start.
• Keys, realm, and environment must agree. Sandbox keys with a sandbox realm and the sandbox environment; production keys with a production realm and the production environment. Mixing them is a top source of empty results and auth errors.

Frequently asked questions

Can ChatGPT access my QuickBooks data?

Yes. The official QuickBooks app inside ChatGPT, live since late 2025 for all logged-in US accounts, can read your data to analyze profit-and-loss, cash flow, and benchmarks, and to generate reports. It's read-only, so it can answer questions about your books but can't change them. For changes, you need an MCP connection or a purpose-built platform.

Is there an official QuickBooks MCP server?

Yes. Intuit publishes an open-source QuickBooks Online MCP server on GitHub with 144 tools, 29 entity types, and 11 financial reports, using OAuth 2.0. It runs locally on your machine, requires a developer account, and connects to one company at a time. It's built for developers, not for daily accounting out of the box.

Do I need a developer account to connect QuickBooks to Claude?

For the official MCP server, yes. Intuit does not issue per-user API keys, so any write-capable connection starts with registering an app on the Intuit Developer Portal and completing an OAuth handshake. The only ways to skip the developer account are the read-only ChatGPT app, a third-party hosted MCP server, or a platform that manages the connection for you.

Can AI make changes to my QuickBooks, like fixing categorizations?

Technically yes, through a write-enabled MCP connection. But a general AI has no accounting judgment: it will miscategorize Stripe deposits, misread transfers, and guess on blank transactions, with no memory of your corrections. Getting the AI connected is easy. Getting it to make correct changes is the hard part, and it's what purpose-built accounting tools exist to solve.

Is it safe to connect QuickBooks to ChatGPT or Claude?

It can be, if you're careful. Start read-only using the server's disable-write flags, test in sandbox before production, never commit or paste your credentials, and keep a human approving any writes. The real risk is a model with unrestricted write and delete access to live books, so the safe setup removes that access until you trust the workflow.

What's the difference between the ChatGPT QuickBooks app and the MCP server?

The ChatGPT app is a free, official, read-only insights tool: ask questions, get reports, change nothing. The MCP server is a developer integration that gives an AI full read-and-write access to your books through 144 tools. The app is for understanding your numbers. The server is for acting on them.

Does the QuickBooks MCP server work with QuickBooks Desktop?

No. The official server is the QuickBooks Online MCP server and connects through the QuickBooks Online API with OAuth. QuickBooks Desktop uses a different, local integration model and isn't supported by this server. If your clients are still on the desktop version, that’s a migration project first — see our guide to moving clients off QuickBooks Desktop.

How much does it cost to connect QuickBooks to an AI?

The official MCP server is free and open-source; your only cost is setup time and your AI client. The ChatGPT QuickBooks app is free with any ChatGPT account. Hosted MCP servers usually charge a monthly or per-seat fee. Purpose-built platforms charge a subscription that includes the accounting logic the raw connections don't have.

Can I connect the AI to more than one QuickBooks company at once?

Not with a single configuration of the official server. It authenticates to one company, identified by one realm ID, per setup. To cover several companies you run several configurations, each with its own credentials. This single-company limit is one of the main reasons bookkeepers with a client roster look at platforms built for multi-company work.

What happens when the refresh token expires?

In normal use it doesn't, because it auto-rotates: each refresh issues a new token and the server saves it to your .env. The connection only breaks if that save fails, for example if the file isn't writable, or if the token goes unused long enough to lapse. If the connection dies, re-running the OAuth handshake issues a fresh token.

Do I need to know how to code to set this up?

You need to be comfortable in a terminal: cloning a repository, running npm commands, and editing a config file. You don't need to write code. If a command line makes you nervous, the free ChatGPT app or a hosted server will get you connected without any of that.

Is the official Intuit MCP server production-ready?

Intuit published it as an open-source preview with a large test suite behind it. It works, and it's official. "Preview" means it's aimed at developers and can change, and that daily-accounting polish, like multi-company support and built-in accounting judgment, isn't its goal. Treat it as a capable building block, not a finished bookkeeping product.

Can AI reconcile my accounts in QuickBooks?

A write-enabled connection can create and edit the records reconciliation touches, but reconciliation is judgment work: matching, catching what doesn't tie out, and knowing when a difference is a real problem. A general AI has the buttons and not the judgment, so treat any reconciliation help as a draft you verify, not a close you trust.

Will this work with my accountant's or bookkeeper's QuickBooks?

Only if you have the access to create an app and authorize the connection for that company. Connecting someone else's books means their realm and their permission. If you're the bookkeeper, that's your call to make with your client and your data-handling rules. If you're the owner, loop in whoever keeps your books before you point an AI at them.

Growthy is bookkeeping software, not a CPA firm. This content is educational, not professional advice.