QuickBooks Online and Tipalti integration

What moves between them

The main flow moves vendor data and invoice reconciliation. Vendors created in QuickBooks Online (new records detected via CDC polling or webhook) are synced to Tipalti as payees for supplier onboarding. Invoices and purchase orders created in Tipalti flow back to QuickBooks Online as bills or bill line item details for matching and reconciliation. Payment approvals and status changes in Tipalti (received via IPN webhooks) update the corresponding bill or bill payment record in QuickBooks Online so both systems stay in sync on payment status. The cadence is event-driven for Tipalti (via webhooks) and polling-based for QuickBooks Online (CDC endpoint) unless you enable QuickBooks Online webhooks, in which case both are push.

How ml-connector handles it

ml-connector manages a complex dual-auth bridge. On the QuickBooks Online side it handles OAuth2 token refresh, caching the access token and refreshing it when approaching expiry, and it maintains the realm_id (company identifier) captured from the OAuth callback so it can target the correct QuickBooks Online instance. On the Tipalti side it switches between SOAP and REST based on the operation: it calculates and signs SOAP requests with HMAC-SHA256 using the payer_name and api_key, and it obtains and refreshes OAuth2 bearer tokens for REST calls. For vendor sync, ml-connector polls the QuickBooks Online CDC endpoint for new or updated vendors, then creates matching payees in Tipalti with the vendor name, tax ID, and address fields. For invoice reconciliation, it receives Tipalti IPN webhook events on a single endpoint, verifies the HMAC-SHA256 signature, and matches the incoming invoice record to an existing QuickBooks Online bill by vendor and invoice number, updating the bill status to match the payment status in Tipalti. Tipalti supports both SOAP and REST but with different function signatures for the same operations, so ml-connector uses REST for the highest compatibility with modern systems. The single Tipalti IPN endpoint means all event types (payee changes, payments, errors) route to the same handler, so ml-connector filters by event type in code. QuickBooks Online webhook payloads are best-effort and may arrive out-of-order or duplicated, so ml-connector deduplicates by entity ID and timestamp. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A services firm uses QuickBooks Online for accounting and Tipalti to manage payments to 150+ independent contractors and vendors across multiple countries. Before the integration, the accounts payable team manually entered invoices from Tipalti into QuickBooks Online and updated bill status by hand when Tipalti approved and scheduled payments. This created a two-week lag and frequent mismatches where Tipalti had approved a payment but QuickBooks Online still showed the bill as open, causing reconciliation headaches and tax compliance delays. With QuickBooks Online and Tipalti connected, new vendors added to the contractor list in QuickBooks Online are automatically onboarded to Tipalti for compliance review, invoices submitted in Tipalti appear as bills in QuickBooks Online within minutes, and payment approvals update bill status automatically. The accounts payable team now spends their time on compliance and vendor management, not on manual data entry, and month-end close happens three days faster because invoices and payments are already reconciled.

What you can do

• •Sync vendors created in QuickBooks Online to Tipalti as payees, with tax IDs and address details for automated supplier onboarding.
• •Match invoices and purchase orders from Tipalti to bills in QuickBooks Online by vendor and invoice number for automatic reconciliation.
• •Update bill and bill payment status in QuickBooks Online when Tipalti approves, schedules, or completes a payment via IPN webhooks.
• •Bridge OAuth2 token refresh on the QuickBooks Online side and manage HMAC-SHA256 SOAP signatures plus OAuth2 on the Tipalti side without manual credential rotation.
• •Poll the QuickBooks Online CDC endpoint and receive Tipalti IPN webhooks with full deduplication, verification, and audit trails on every record.

Questions

Which direction does data move between QuickBooks Online and Tipalti?

The flow is bidirectional by record type. Vendors move from QuickBooks Online to Tipalti for payee onboarding. Invoices and purchase orders move from Tipalti to QuickBooks Online for bill matching and reconciliation. Payment status changes in Tipalti update bill status in QuickBooks Online.

How does ml-connector handle the different authentication schemes on each side?

ml-connector maintains separate credential stores and token refresh cycles for each system. On QuickBooks Online, it refreshes OAuth2 access tokens on schedule and caches the realm_id. On Tipalti, it calculates HMAC-SHA256 signatures for SOAP calls using the payer_name and api_key, and maintains a separate OAuth2 client credentials flow for REST calls to triggers.approve.com.

What happens when Tipalti's single IPN webhook endpoint receives multiple event types?

ml-connector routes all Tipalti events (payee changes, payment submissions, approvals, errors) to the same webhook handler, verifies the HMAC-SHA256 signature once, and then filters by event type in code to dispatch the right handler. This lets you use a single integration point while processing different record types.