SAP Business One and GoCardless integration

What moves between them

The main flow runs from GoCardless into SAP Business One. After each reconciliation window, ml-connector reads GoCardless payouts and payment events, matches each payment against open invoices in SAP, and posts reconciliation journal entries into the general ledger with the correct customer dimension and profit center. Customer records are kept aligned so SAP Business One has the full payment activity for each customer. Refunds and failed payments are tracked in the audit trail. Journal entries are never written back to GoCardless.

How ml-connector handles it

ml-connector stores both credential sets encrypted and maintains the SAP Business One session token with refresh before expiry to avoid the 30-minute inactivity timeout. On the GoCardless side, it validates the incoming webhook HMAC-SHA256 signature on every request and only processes events with valid signatures. Because SAP Business One is on-premise and requires a customer-provided Service Layer URL, ml-connector accepts that full URL per customer and polls on a schedule tied to your payment collection cycle. Payouts in GoCardless are read-only, so ml-connector never attempts to create or modify them; it only reads and reconciles. GoCardless rate limits are handled with exponential backoff and retry, and every record carries a full audit trail so failed GL postings can be replayed.

A real-world example

A mid-sized business services firm runs SAP Business One for accounting across multiple profit centers and uses GoCardless to collect recurring service fees directly from customer bank accounts in multiple countries. Before the integration, the accounting team pulled weekly payout reports from GoCardless, manually looked up matching invoices in SAP, and posted journal entries by hand. The process was error-prone and took 4-6 hours every week. With SAP Business One and GoCardless connected, each payout and payment is matched to the original invoice automatically, reconciliation journal entries post into the correct profit center, and the team has a complete audit trail from bank debit to GL posting without re-keying.

What you can do

• •Read GoCardless payouts and payment events on a schedule and match each to the corresponding customer invoice in SAP Business One.
• •Post reconciliation journal entries into SAP Business One's general ledger allocated to the correct customer dimension and profit center.
• •Validate GoCardless HMAC-SHA256 webhook signatures and process real-time payment events as they arrive.
• •Maintain encrypted SAP Business One session tokens with refresh before expiry, and encrypted GoCardless bearer tokens.
• •Track refunds, failed payments, and all reconciliation posting with a full audit trail in ml-connector.

Questions

Which direction does data move between SAP Business One and GoCardless?

The main flow is GoCardless into SAP Business One. Payouts, payments, and customer records move from GoCardless into SAP for matching and reconciliation. Journal entries posted into SAP's general ledger reference the original customer invoice and are never written back to GoCardless, which treats payouts as read-only.

How does ml-connector handle the SAP Business One session token and GoCardless bearer token?

ml-connector stores both credentials encrypted and refreshes the SAP Business One session token before the 30-minute inactivity timeout expires to prevent authentication failures. GoCardless bearer tokens are reused across requests and do not expire by default. Both integrations use constant-time comparison and secure storage to prevent credential leakage.

What happens if GoCardless payouts don't match an open invoice in SAP Business One?

ml-connector records the payout in the audit trail with its match status and can hold unmatched payouts for manual review or for matching against future payments. All reconciliation decisions are logged so accounting can trace why a payout was matched or deferred, and failed GL postings can be replayed after the underlying invoice is created.