How does ml-connector handle Exact Online's short-lived access tokens and rotating refresh tokens?

ml-connector refreshes the Exact Online access token every 10 minutes to stay well ahead of the 10-minute expiry, and it stores the rotating refresh token encrypted so that each successful refresh updates the stored credential for the next refresh cycle. If a refresh fails, the error is logged and surfaced in the audit trail so the integration operator can re-authorize the user before further syncs occur.

What happens if a ShipBob order references a product that does not exist in Exact Online?

ml-connector first queries Exact Online for an item matching the ShipBob SKU using OData filtering. If no match is found, the shipment is flagged and held in the audit log with the ShipBob order details, waiting for manual intervention. The sales team can then either map the SKU in ShipBob to an existing Exact Online item or create the item in Exact Online and re-trigger the sync.

Does ml-connector need a different setup for each Exact Online region?

Yes. During initial setup, the customer provides their Exact Online base URL (https://start.exactonline.nl/, .be, .uk, .de, .fr, .es, or .com) and their division ID, both of which ml-connector stores per customer. When the customer moves divisions or regions, those values are updated and the next sync uses the new endpoint without any code changes.

Exact OnlineShipBob

Exact Online and ShipBob integration

Exact Online runs accounting, invoicing, and inventory for European SMEs. ShipBob handles order fulfillment and shipping. Connecting the two ensures orders fulfilled by ShipBob automatically appear as sales invoices in Exact Online, shipment confirmations flow back to ShipBob, and inventory adjustments keep both systems in sync. ml-connector handles the very different OAuth flows and payload shapes for each system and orchestrates the sync on a schedule you control.

How Exact Online works

Exact Online exposes accounts, sales orders, sales invoices, purchase orders, GL accounts, cost centers, items, and more through REST APIs with OData v3 query syntax. All calls go to region-specific base URLs (Netherlands, Belgium, UK, Germany, France, Spain, or USA) and require a division ID. Authentication uses OAuth 2.0 Authorization Code flow, with access tokens expiring every 10 minutes and refresh tokens rotating every 30 days. Exact Online supports webhooks on a push model for subscribed topics including sales orders, sales invoices, and items, with HMAC-SHA256 signature verification, but related entities must be fetched via separate REST calls because entity expansion is not supported.

How ShipBob works

ShipBob exposes orders, shipments, products, inventory, warehouse receiving orders, and returns through JSON REST APIs at https://api.shipbob.com. Authentication uses OAuth 2.0 Authorization Code flow with access tokens expiring every hour, or a Personal Access Token for single-merchant integrations, and every call requires a shipbob_channel_id header identifying the merchant application channel. ShipBob supports webhooks on events including order.shipped, order.shipment.tracking.updated, return.created, and wro.created (warehouse receiving), all signed with HMAC-SHA256 v1 envelope.

What moves between them

Orders placed in ShipBob fulfillment centers trigger a webhook when shipment is ready. ml-connector reads the shipment details from ShipBob, looks up the corresponding item in Exact Online, and posts a sales invoice and sales order into Exact Online's general ledger. Shipment tracking updates from ShipBob flow back and can be recorded in Exact Online's customer communication history. Inventory receiving at ShipBob (warehouse receiving orders) triggers an update to Exact Online's item stock levels so accounting and fulfillment agree on inventory on hand.

How ml-connector handles it

ml-connector stores both OAuth credential sets encrypted and refreshes the Exact Online token every 10 minutes (before expiry) and the ShipBob token every 55 minutes to stay ahead of their expiry windows. It maps ShipBob orders to Exact Online items using SKU or product code, validates that the item exists and the quantity is available in Exact Online before posting the invoice, and handles the case where a SKU in ShipBob has no match in Exact Online by flagging the record for manual review. Exact Online's requirement for a division ID is resolved per customer during setup. ShipBob's channel_id requirement is supplied in every write call. ml-connector verifies HMAC signatures on both webhook payloads and retries failed posts with exponential backoff, and it tracks each shipment's tracking number and delivery status across both systems.

A real-world example

A European SME selling consumer goods uses Exact Online for invoicing and GL posting and ships orders through ShipBob fulfillment centers in the Netherlands and UK. Before the integration, the operations team received ShipBob shipment confirmations by email, manually entered the orders into Exact Online as sales invoices, and typed the tracking numbers into customer emails by hand. With Exact Online and ShipBob connected, each ShipBob order automatically posts as an invoice in Exact Online, mapped to the correct product and invoice date, and tracking numbers flow back to Exact Online so the sales team can send customer shipping notifications directly from the ERP.

What you can do

Sync fulfilled orders from ShipBob into Exact Online as sales invoices and sales orders, mapped by SKU to Exact Online items.
Validate order quantities against Exact Online inventory before posting, and flag mismatches for manual review.
Refresh OAuth tokens for both Exact Online (every 10 minutes) and ShipBob (every 55 minutes) to prevent authentication timeouts.
Receive warehouse receiving updates from ShipBob and post inventory adjustments to Exact Online item stock levels.
Verify HMAC-SHA256 signatures on webhooks from both systems and replay failed records with exponential backoff.

Questions

How does ml-connector handle Exact Online's short-lived access tokens and rotating refresh tokens?: ml-connector refreshes the Exact Online access token every 10 minutes to stay well ahead of the 10-minute expiry, and it stores the rotating refresh token encrypted so that each successful refresh updates the stored credential for the next refresh cycle. If a refresh fails, the error is logged and surfaced in the audit trail so the integration operator can re-authorize the user before further syncs occur.
What happens if a ShipBob order references a product that does not exist in Exact Online?: ml-connector first queries Exact Online for an item matching the ShipBob SKU using OData filtering. If no match is found, the shipment is flagged and held in the audit log with the ShipBob order details, waiting for manual intervention. The sales team can then either map the SKU in ShipBob to an existing Exact Online item or create the item in Exact Online and re-trigger the sync.
Does ml-connector need a different setup for each Exact Online region?: Yes. During initial setup, the customer provides their Exact Online base URL (https://start.exactonline.nl/, .be, .uk, .de, .fr, .es, or .com) and their division ID, both of which ml-connector stores per customer. When the customer moves divisions or regions, those values are updated and the next sync uses the new endpoint without any code changes.

Connect Exact Online and ShipBob

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started