Quickstart

Register an app, connect it to a sandbox company with sample books, and make your first API call. Nothing here touches your real books.

1. Register an app

Sign in and register an app. Give it a name and a redirect URI, and pick the reports and money_in scopes for this walkthrough.

Copy the client ID and client secret from the next screen. The secret isn't shown again. A new app starts in development mode, so only you can connect it.

2. Set up a sandbox company

On Your apps, choose Set up sandbox company. You get a practice company with sample invoices, bills and bank activity, so an unfinished app has something safe to write to. It takes a few seconds.

The sample data resets about once a month, so don't keep anything there you need.

3. Connect your app

Every app uses PKCE. Make a random code_verifier, keep it, and send its SHA-256 hash as the code_challenge:

import { createHash, randomBytes } from "node:crypto"; const verifier = randomBytes(32).toString("base64url"); const challenge = createHash("sha256").update(verifier).digest("base64url");

Then open the authorization URL in a browser:

https://imprest.ai/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=code&scope=reports+money_in&code_challenge=YOUR_CODE_CHALLENGE&code_challenge_method=S256

Your sandbox company comes first on the consent screen and is already selected. Choose Allow, and Imprest sends the browser to your redirect URI with a code parameter.

Already connected this app to another company? It reconnects there without showing the screen. Disconnect it first under Settings, Security, Linked apps.

4. Get a token

Exchange the code for an access token, with the verifier from step 3:

Token exchange
curl -X POST https://imprest.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "YOUR_REDIRECT_URI",
    "code_verifier": "YOUR_CODE_VERIFIER"
  }'

5. Make your first call

The token is bound to the company you picked, so there's no company header to send:

List invoices
curl https://imprest.ai/api/v1/invoices \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Next steps