QuickBooks Online and Coupa integration

What moves between them

The primary flow moves suppliers from Coupa into QuickBooks Online as vendors, enriched with supplier data (name, status, contact info) so procurement records are visible to accounting. Invoices flow in both directions: unpaid invoices from Coupa can be queued for entry into QuickBooks bills if needed, and reconciled invoices with payment status from QuickBooks update back to Coupa so the procurement team sees actual GL posting. GL journals from paid invoices route into QuickBooks accounts and departments linked to supplier cost centers. Syncs are triggered by Coupa webhook events but also polled on schedule for orphaned records and idempotency.

How ml-connector handles it

ml-connector stores QuickBooks and Coupa OAuth credentials encrypted and manages the token lifecycle on each side: refreshing QuickBooks tokens before expiry and re-authenticating with Coupa client credentials when needed. It verifies every Coupa webhook with the shared HMAC-SHA256 secret and discards replays. On inbound supplier events, it upserts vendors into QuickBooks using the exact SyncToken concurrency model QuickBooks requires. On invoice events, it maps Coupa line items to QuickBooks accounts and departments, then creates or updates bills. Coupa enforces 30-second timeouts and rate-limit retries with exponential backoff; ml-connector enforces the same backoff strategy and tracks both systems' rate-limit headers. Every record carries a webhook event ID and audit trail, so replaying a failed GL post does not create duplicate entries. The integration can reconcile via order matching: Coupa PO number matched to QuickBooks bill memo, or supplier ID matched to vendor ID.

A real-world example

A small manufacturing company runs QuickBooks Online for accounting and Coupa for supplier and PO management. Before the integration, the procurement team created POs in Coupa, received goods, approved invoices, and mailed vendor details to accounting. The accountant manually re-entered each invoice into QuickBooks, then reconciled Coupa's PO list against QuickBooks' bill register monthly, hunting for missing or duplicate entries. With QuickBooks and Coupa connected, new suppliers in Coupa appear in QuickBooks automatically, invoices sync both ways, and the accountant starts each month with both systems already reconciled. Exceptions are rare, and when they occur an audit trail shows exactly which record caused the mismatch.

What you can do

• •Sync supplier records from Coupa to QuickBooks Online as vendors, including name, status, and payment terms.
• •Bridge unpaid invoices from Coupa into QuickBooks bills, mapped to the correct GL accounts and departments.
• •Verify Coupa webhook signatures using HMAC-SHA256 and prevent replay of duplicate events.
• •Manage QuickBooks OAuth token refresh and Coupa client-credentials re-authentication without manual intervention.
• •Retry failed invoice syncs with exponential backoff and maintain a complete audit trail for reconciliation and replay.

Questions

Which direction do invoices flow between QuickBooks Online and Coupa?

Invoices flow primarily from Coupa into QuickBooks Online as bills, mapped to supplier accounts and GL departments. Once an invoice is paid in QuickBooks, the payment status syncs back to Coupa so the procurement team sees the GL posting. This bidirectional flow keeps both systems' invoice registers in agreement without manual re-entry.

How does ml-connector handle QuickBooks' OAuth token expiry?

QuickBooks access tokens expire in 1 hour and refresh tokens rotate every 24-26 hours. ml-connector stores both encrypted, monitors expiry times, and refreshes the access token before it expires. If a refresh token rotates, the system detects the new token in the OAuth callback and re-syncs without disruption. A stale token forces re-authentication, which the integration surface to you with an actionable alert.

Does the Coupa webhook signature verification protect against tampering?

Yes. Coupa signs every webhook with HMAC-SHA256 using a shared secret. ml-connector verifies the signature on every incoming event and rejects unsigned or invalid requests with a 401 response. It also tracks Coupa event IDs to prevent replay of duplicate webhook deliveries, so a supplier update that arrives twice will only sync once to QuickBooks.