Wave Accounting and SFTP / Flat Files integration

What moves between them

Invoices, customers, products, and GL transactions flow from your SFTP server into Wave Accounting. Your file-producing partner deposits new data files in the inbound folder on a schedule or in response to a business event (e.g. month-end invoicing run). ml-connector polls the SFTP server every 5 to 60 minutes, reads new files, parses each record, and POSTs the data into Wave via its GraphQL API using OAuth. The calendar is entirely in your control. Files are marked as processed and moved to the processed folder after successful ingestion. If a file format is invalid or a Wave API call fails, the file lands in the error folder and an alert is sent.

How ml-connector handles it

ml-connector stores your SFTP host, username, and private key encrypted in Postgres, verifies the SFTP server's host key on every connection to prevent MITM attacks, and refreshes your Wave OAuth token transparently when a call returns 401. It polls your inbound folder on your chosen schedule (typically 5-60 minute intervals), reads the file, applies a mapping spec you define that converts the file's columns or EDI segments into Wave customer, invoice, product, or account entities, batches the records, and POSTs them to Wave's GraphQL API. After the API confirms success, ml-connector moves the file to processed/. If parsing fails (malformed CSV, invalid EDI segment) or Wave rejects the data (missing required field, duplicate invoice), ml-connector logs the issue, moves the file to error/, and sends an alert. The mapping spec is a JSON document you configure once per file type. Wave's GraphQL schema does not support AP bills or purchase orders, only AR invoices and one-way transaction posting, so the connector focuses on those. Every record carries a full audit trail with timestamps, file name, row number, and API response.

A real-world example

A small services firm uses Wave Accounting for AR and general ledger, but their long-time vendor submits invoices monthly as a CSV file uploaded to an SFTP server shared between the two. Before the integration, the finance team downloaded the CSV, opened it in Excel, hand-created invoice records in Wave, and reconciled amounts against the vendor statement. With Wave and SFTP / Flat Files connected, the vendor's monthly invoice file arrives on the shared SFTP server, ml-connector polls it, detects the new file, parses the invoice rows, creates the invoice records in Wave under the vendor customer, and posts GL entries to the vendor liability account. The firm's finance team now sees invoices in Wave the same day they appear on the SFTP server, with zero re-keying and a complete audit trail.

What you can do

• •Poll an SFTP server on a configurable schedule and detect new invoice, customer, product, and transaction files.
• •Parse CSV, X12 EDI, and fixed-width file formats and map their fields into Wave Accounting's GraphQL schema.
• •Authenticate Wave Accounting with OAuth 2.0 and refresh the access token transparently on 401 responses.
• •Validate SFTP host keys, store credentials encrypted, and move processed files to an archive folder with error handling.
• •Maintain a complete audit trail on every record with file name, row number, parse result, and Wave API response.

Questions

Does the integration support AP invoices or bills into Wave?

No. Wave Accounting's GraphQL API exposes only AR invoices, not bills or purchase orders. The integration focuses on customer invoices, transactions, and GL entries posted to the chart of accounts. If you need to receive supplier bills, you will need a different accounting system or a separate inbound AP process.

What file formats does the SFTP / Flat Files connector support?

CSV, X12 EDI (including 850 PO and 810 invoice segments), EDIFACT, XML, and fixed-width text. The mapping spec you define tells ml-connector which columns or segments map to Wave entities, so you can adapt to almost any file format your partner produces.

How does ml-connector handle Wave's 2-hour OAuth token expiry?

ml-connector caches your Wave refresh token and monitors the access token's expiry time. When a call returns 401 Unauthorized, ml-connector refreshes the token using the offline_access scope, retries the request, and continues without interrupting the polling schedule. If the refresh fails (e.g. your refresh token is revoked), an alert is sent and the sync pauses until you re-authorize.