Wave Accounting and Tipalti integration

What moves between them

Wave invoices created or updated flow into Tipalti as bills in the accounts payable pipeline. Wave customers are mapped to Tipalti payees so that supplier records exist before invoices arrive. Purchase order references from Wave flow into Tipalti purchase orders. Payment approvals and payment events generated by Tipalti flow back into Wave as transactions linked to the original invoice, keeping Wave's general ledger in sync with payment activity. The sync runs on webhook events from Wave and polls Tipalti payment status on a schedule.

How ml-connector handles it

ml-connector stores Wave OAuth credentials and Tipalti API keys encrypted per customer. On Wave webhook receipt, it verifies the HMAC-SHA256 signature using Wave's public key and the 5 minute replay window, then transforms the Wave invoice payload into Tipalti bill and PO structures. It refreshes the Wave access token when calls return 401 or when expiry approaches. For Tipalti, it signs SOAP requests with the payer HMAC key and includes the x-api-key header on REST calls, and verifies inbound Tipalti payment webhooks against their HMAC-SHA256 signature. Because Wave exposes invoices through GraphQL pull only, ml-connector also periodically queries for invoice updates that may not have triggered a webhook, particularly for approved and sent states. Payment batches processed in Tipalti are polled and converted back into Wave transactions recorded against the original invoice customer. Every record carries a full audit trail and can be replayed if a downstream transformation fails.

A real-world example

A mid-sized consulting and staffing firm uses Wave Accounting for invoicing clients and tracking vendor payments. They also use Tipalti to manage payments to freelance contractors and subcontractors across multiple countries, handling tax compliance and payment processing. Before the integration, the accounts payable team received invoices in Wave, logged into Tipalti separately to create bills and POs, tracked payment approvals across two systems, and manually recorded payments back into Wave. With Wave and Tipalti connected, each supplier invoice created in Wave flows directly into Tipalti for approval and processing, payee records are automatically created when suppliers are added to Wave, and payment completions flow back into Wave's transaction history. The accounting team no longer splits their time between systems, month-end reconciliation is automatic, and the audit trail captures every step.

What you can do

• •Sync Wave invoices and customers into Tipalti bills, purchase orders, and payee records as suppliers are added.
• •Map Wave customer entities to Tipalti payees so payment approvals reference the correct supplier.
• •Flow payment completions from Tipalti back into Wave as transactions linked to the original invoice.
• •Verify webhook signatures from both Wave and Tipalti using HMAC-SHA256 and replay-window checks.
• •Refresh Wave OAuth2 tokens, poll for missed invoice updates, and retry failed transformations with a complete audit trail.

Questions

Which direction does data move between Wave and Tipalti?

Invoices and customers move from Wave into Tipalti as bills, POs, and payees. Payment events and approvals flow back from Tipalti into Wave as transactions linked to the original invoice. The sync is triggered by Wave webhooks and augmented with periodic polling for missed updates.

How does ml-connector handle Wave's OAuth2 token expiry?

ml-connector stores the OAuth credentials encrypted and tracks token expiry. When an API call returns 401, or when expiry approaches, it refreshes the access token automatically using the refresh token and offline_access scope, without interrupting the workflow.

What happens if a Wave webhook signature is invalid?

ml-connector verifies every Wave webhook payload against the HMAC-SHA256 signature and the 5 minute replay window. Invalid or replayed webhooks are rejected with no further processing, and the failure is logged for audit.