The Fortnox API is the REST API that lets other systems read and write data in a Fortnox company: customers, invoices, articles, orders, payments and bookkeeping. Fortnox is the accounting system most Swedish businesses use, and its API is the foundation of every Fortnox integration, from webshops and payment providers to reporting tools and AI agents.
This guide is for developers and agencies building against Fortnox. It covers what the API offers, how to get access, how authentication and limits work, the most common pitfalls, and three ways to work with the API.
The Fortnox API in short: a REST API at
https://api.fortnox.se/3/. Authentication with OAuth2 (Authorization Code Flow). Access tokens last 1 hour, refresh tokens 45 days. A limit of 25 requests per 5 seconds (300 per minute) per integration and Fortnox company. You create your integration in the Fortnox Developer Portal.
What can you do with the Fortnox API?
The API covers most of Fortnox. Which parts an integration can reach depends on its scopes and on which modules the customer's Fortnox company has.
| Area | Examples of what you can do |
|---|---|
| Customers and suppliers | Search, create and update customers and suppliers |
| Customer invoices and payments | Create, book, credit and send invoices, register incoming payments |
| Orders and offers | Create orders and offers and turn them into invoices |
| Articles and prices | Read and update articles, price lists and prices |
| Supplier invoices | Read supplier invoices and register payments |
| Bookkeeping | Accounts, vouchers, financial years, cost centers and projects |
| Warehouse | Stock levels and stock movements, if the customer has the warehouse module |
How to get started with the Fortnox API
- Register in the Fortnox Developer Portal. That's where you create and manage your integrations.
- Create an integration. Give it a name, choose the scopes it needs and set a redirect URI. You get a Client-Id and a Client-Secret.
- Test in a test environment. The Developer Portal lets you create test companies, so you don't test against real books.
- Let the customer activate the integration. The customer signs in to Fortnox, sees which permissions the integration asks for and approves. An authorization code comes back to your redirect URI.
- Exchange the code for tokens and start calling the API. With the access token you can call, for example,
GET https://api.fortnox.se/3/companyinformation.
Authentication: OAuth2 in Fortnox
Fortnox uses OAuth2 with the Authorization Code Flow. The Client-Id, Client-Secret and authorization code are only used when the connection to a customer company is created. After that, you work with tokens:
- The access token lasts 1 hour and is sent as a Bearer token with every call.
- The refresh token lasts 45 days and is used to get a new access token. Each time you do that, you also get a new refresh token, and the old one stops working. Always store the new one straight away.
- If the refresh token expires, the customer has to activate the integration again.
The older method with a fixed access token has been phased out, so new integrations should be built on OAuth2. For integrations that act for the whole company rather than one user, Fortnox also offers service accounts, activated by an administrator.
Scopes
Scopes limit which parts of the customer's Fortnox an integration can reach, for example invoice, customer, article or bookkeeping. Only ask for the scopes you actually need.
One thing to know before you go live: changing an integration's scopes doesn't affect customers who have already activated it. They keep their original scopes until they activate the integration again.
Fortnox API rate limits
Fortnox allows 300 requests per minute per integration and Fortnox company, measured in a sliding 5-second window. In practice, that means 25 requests per 5 seconds. Go over it and the API responds with HTTP 429 (Too Many Requests).
The limit applies per access token, not per IP address. If your integration has five customers, you have 300 requests per minute for each of them.
How to stay under the limit:
- Handle 429 with a wait and retry, rather than repeating the call immediately
- Fetch lists page by page with many records per page, rather than one record at a time
- Cache what rarely changes, like the chart of accounts, VAT codes and terms of payment
- Spread large imports over time
Common pitfalls when building against Fortnox
Most problems in Fortnox integrations aren't about the API, but about how the customer's Fortnox is set up. These are the ones we see most:
- VAT accounts and rates. An order with a VAT rate that has no account in Fortnox can't be booked. Check the customer's VAT settings, especially for sales to other EU countries.
- OSS accounts. If the customer sells to consumers in other EU countries, sales and VAT per country need the right accounts.
- Locked periods. You can't book into a locked period. Plan for what should happen to transactions that arrive late.
- Payment methods and accounts. Every payment method in the webshop needs a matching payment method and account in Fortnox.
- Customers and articles created twice. Decide how you match against existing customers and articles before creating new ones.
- The customer's license. The customer's Fortnox package needs to include integrations, or the integration can't be connected.
Our guide Fortnox settings before starting integration walks through these settings step by step.
Three ways to work with the Fortnox API
| Build it yourself | Integration platform | Through AI with Fortnox MCP | |
|---|---|---|---|
| Suits | A unique integration with its own behavior | Common flows, like webshop and payment provider to Fortnox | Questions, analysis and one-off tasks |
| You handle | OAuth2, tokens, rate limits, mapping, errors and maintenance | Settings and mapping | The question, and what the AI may do |
| Time to first result | Weeks | Days | Minutes |
1. Build it yourself
You create the integration in the Developer Portal and handle everything yourself: authentication, tokens, limits, mapping, error handling and updates when the API changes. The right choice when the integration is the core of your product.
2. Integration platform
For common e-commerce flows, like orders, payouts, returns and stock between webshop, payment provider and Fortnox, ready-made integrations exist. Junipeer has ready-made connections between Fortnox and systems like Shopify, WooCommerce, Magento, Klarna, Svea and Walley. See Fortnox integrations.
3. Through AI with Fortnox MCP
With Fortnox MCP, an AI agent like Claude Code, Cursor, Claude or ChatGPT can use the Fortnox API through Junipeer. The agent can, for example, read a customer's chart of accounts and VAT codes before you build, or check which fields an invoice has. You don't handle any Client-Secrets or tokens yourself: they stay with Junipeer. Fortnox MCP costs €39/mo plus €2 per 1,000 requests. Read more about Fortnox MCP.
The commands for Claude Code, Codex, Cursor, Gemini CLI and VS Code are on MCP for developer tools.