Which direction does data move between Exact Online and Brex?

The primary flow is from Brex into Exact Online. Card transactions and accounting records post as purchase invoices or GL entries, while vendor and account master data sync in both directions to keep suppliers and GL mappings aligned. GL records from Brex are read-only in Exact Online since Exact Online is the financial authority.

How does ml-connector handle the different OAuth token lifetimes?

Exact Online access tokens expire after 10 minutes, so ml-connector refreshes them proactively using the 30-day rotating refresh token before each API call. Brex OAuth tokens expire after 1 hour, and ml-connector tracks expiry and refreshes on demand. Static Brex bearer tokens do not refresh and expire after 90 days of inactivity.

What happens when a Brex webhook signature verification fails?

ml-connector rejects the webhook with a 401 response so Brex knows to retry it via Svix, which handles exponential backoff and eventual delivery. The failed signature is logged for audit, and when legitimate retries arrive with valid signatures, they are processed and deduplicated by transaction ID.

Exact OnlineBrex

Exact Online and Brex integration

Exact Online is your ERP and accounting system of record. Brex manages your corporate cards, spend, and vendor payments. Connecting the two keeps your expense records and GL synchronized. Every corporate card transaction in Brex flows into Exact Online as a purchase invoice or GL entry allocated to the correct cost center, and your vendor and account master data stays aligned across both platforms. ml-connector handles the different auth models and moves the data on the schedule you control.

How Exact Online works

Exact Online is a cloud ERP and accounting platform that exposes accounts, purchase invoices, sales invoices, GL accounts, cost centers, journal entries, projects, and other entities through a REST API with OData v3 query syntax. It authenticates via OAuth 2.0 Authorization Code Grant with a 10-minute access token and 30-day rotating refresh token, requiring app registration in the Exact Online App Center. Exact Online supports webhooks for a significant set of resources, including purchase invoices, GL accounts, transaction lines, and documents, delivered via HTTP POST with HMAC-SHA256 signature verification. All API calls require a division ID, and related entities must be fetched in separate requests since the API does not support expand parameters.

How Brex works

Brex is a corporate spend management platform offering corporate cards, expense management, bill pay, and banking services. The Brex API exposes transactions, expenses, accounting records, vendors, budgets, and user data through REST endpoints at https://api.brex.com, authenticated with bearer tokens or OAuth 2.0. Transactions are read-only while expenses, vendors, transfers, and budgets support write operations. Brex supports webhooks via Svix for transfer, expense, user, and accounting record events with HMAC-SHA256 signature verification. Writes to transfer endpoints require an Idempotency-Key header, and expense endpoints return a maximum of 100 records per page.

What moves between them

The main flow is from Brex into Exact Online. After card transactions settle in Brex, ml-connector reads spend and accounting records via webhook or API polling and posts them into Exact Online as purchase invoices or GL transactions, allocated to cost centers based on card assignment and Brex budget mappings. Vendor and account master data, including vendor names, payment terms, and GL mappings, are synced bidirectionally so Brex vendors match Exact Online supplier accounts. GL records created in Brex after card settlement are read into Exact Online but never written back, since Exact Online is the authority for financial entries.

How ml-connector handles it

ml-connector stores both API keys and OAuth tokens encrypted and refreshes Exact Online tokens before they expire every 10 minutes; for Brex, it handles both static bearer tokens and OAuth 2.0 with 1-hour token lifetime. It validates Brex webhook signatures using the Svix secret and Exact Online webhook signatures using the HMAC-SHA256 secret from the App Center, ensuring only authentic payloads are processed. On card transaction settlement, ml-connector fetches the full transaction and accounting record details from Brex, maps the Brex category and cardholder budget to a matching Exact Online cost center and GL account, and creates a purchase invoice line with the correct amount and description. Vendor information is fetched from Brex and matched or created as a supplier account in Exact Online. The division ID is stored per customer, and each API call to Exact Online includes it. Transfer operations to Brex include the required Idempotency-Key to prevent duplicates on retry, and failed posts are retried with exponential backoff while maintaining a full audit trail.

A real-world example

A growing software company manages corporate spending through Brex cards across engineering, sales, and operations teams. Previously, expense reports from Brex were downloaded monthly and manually entered into Exact Online, with cost center and vendor matching done by hand, creating reconciliation delays and errors. With Brex and Exact Online connected, each settled card transaction automatically posts as a purchase invoice in the correct department cost center with the correct vendor, eliminating manual entry. Month-end close now shows spend allocation by team immediately, and the finance team can spot unusual category spending without waiting for expense approvals.

What you can do

Post Brex card transactions and accounting records into Exact Online as purchase invoices allocated to cost centers.
Sync vendor master data between Brex and Exact Online to keep supplier accounts and payment terms aligned.
Map Brex budget categories and cardholder assignments to Exact Online cost centers and GL accounts.
Authenticate Exact Online with OAuth 2.0 and 30-day rotating refresh tokens, and Brex with bearer tokens or OAuth 2.0.
Verify Brex Svix and Exact Online webhook signatures, retry on failure, and maintain a complete audit trail.

Questions

Which direction does data move between Exact Online and Brex?: The primary flow is from Brex into Exact Online. Card transactions and accounting records post as purchase invoices or GL entries, while vendor and account master data sync in both directions to keep suppliers and GL mappings aligned. GL records from Brex are read-only in Exact Online since Exact Online is the financial authority.
How does ml-connector handle the different OAuth token lifetimes?: Exact Online access tokens expire after 10 minutes, so ml-connector refreshes them proactively using the 30-day rotating refresh token before each API call. Brex OAuth tokens expire after 1 hour, and ml-connector tracks expiry and refreshes on demand. Static Brex bearer tokens do not refresh and expire after 90 days of inactivity.
What happens when a Brex webhook signature verification fails?: ml-connector rejects the webhook with a 401 response so Brex knows to retry it via Svix, which handles exponential backoff and eventual delivery. The failed signature is logged for audit, and when legitimate retries arrive with valid signatures, they are processed and deduplicated by transaction ID.

Connect Exact Online and Brex

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started