Zoho Books and Brex integration

What moves between them

Brex expense and accounting records flow into Zoho Books. When a card transaction is approved in Brex or an accounting record is ready for export, ml-connector reads that record, maps it to a vendor in Zoho Books, and posts it as a journal entry or vendor invoice in the correct GL account and cost center. Expense reimbursements follow the same path. Reference data such as vendors, cost centers, and GL accounts are synced in both directions so Brex expense approvals land on valid Zoho Books dimensions. Because Brex transactions are read-only, ml-connector never writes spend data back to Brex.

How ml-connector handles it

ml-connector stores Zoho Books OAuth2 credentials (client ID, client secret, and refresh token) encrypted, along with the organization ID and the regional base URL resolved from the token response. On the Brex side it accepts either a static API key or OAuth2 credentials (access token and refresh mechanism). Brex webhooks arrive via Svix and ml-connector verifies the HMAC-SHA256 signature against the stored webhook secret before processing. For each Brex transaction or expense, ml-connector retrieves the matching vendor from Zoho Books or creates one if needed, determines the GL account and cost center from the expense details, and posts a journal entry. Since Zoho Books access tokens expire after 1 hour, ml-connector refreshes proactively at 55 minutes. Brex API keys expire after 90 days of inactivity, so token renewal is tracked to prevent outages. Idempotency keys on Brex transfers prevent duplicate posts if a request is retried. Every record carries the BullMQ jobId for deduplication and the full audit trail for replay if a downstream call fails.

A real-world example

A mid-sized services firm uses Zoho Books for accounting and Brex for corporate cards and expense reimbursement. Before the integration, the finance team collected approved Brex expenses weekly, mapped each one to a vendor or cost center, and manually posted them as journal entries in Zoho Books. Reconciliation took hours because expense amounts, dates, and GL accounts had to be verified against Brex records. With Zoho Books and Brex connected, approved expenses post to the correct journals automatically on the Brex approval schedule, and the GL accounts are pre-populated from expense categories. Month-end reconciliation now starts with all card and reimbursement data already in the ledger.

What you can do

• •Post Brex card transactions and expenses into Zoho Books journals and vendor invoices, allocated to the correct GL accounts and cost centers.
• •Sync vendor reference data between Brex and Zoho Books so expense approvals land on valid accounts.
• •Authenticate Brex via static API key or OAuth2, and Zoho Books with OAuth2 plus region-specific base URL routing.
• •Verify Brex webhook signatures via HMAC-SHA256 and handle idempotency keys on all Brex transfers.
• •Track token and API key expiry (Zoho 1-hour access tokens, Brex 90-day inactivity) and refresh proactively to prevent outages.

Questions

Which direction does data move between Zoho Books and Brex?

The main flow is Brex into Zoho Books. Approved expenses and accounting records move from Brex into Zoho Books as journal entries or vendor invoices. Vendor reference data is synced in both directions so Brex expense categories match Zoho Books GL accounts and vendors. Brex transactions are read-only, so ml-connector never writes spend data back into Brex.

How does ml-connector handle Zoho Books' region-specific base URLs and OAuth2?

ml-connector stores the Zoho Books OAuth2 credentials (client ID, client secret, and refresh token) encrypted, and resolves the regional base URL from the token response (api_domain field). All API calls route to the correct regional endpoint. Access tokens expire after 1 hour, so ml-connector refreshes proactively at 55 minutes to avoid disruption.

What happens when Brex API keys or tokens expire?

Brex static API keys expire after 90 days of inactivity; ml-connector tracks the expiry date and alerts before renewal is needed. OAuth access tokens expire after 1 hour and are refreshed by the same mechanism as Zoho Books. Both expirations are monitored to prevent outages during scheduled syncs.