If every check passes, will Intuit approve my app?

No. This is a self-check, not a certification, penetration test or security audit. It catches common, mechanical issues. Intuit decides on approval through its own review, which this tool does not replicate and has no part in.

Is the QuickBooks app review check open source?

Yes. The scanner is MIT licensed on GitHub at github.com/apideck-libraries/quickbooks-review-check. The code that scans your repository in this page is the same code, so you can read exactly what runs in your browser. Issues and pull requests for new checks are welcome.

Does this apply to Intuit Enterprise Suite apps?

Yes. Intuit’s Intuit Enterprise Suite developer docs say to follow the QuickBooks Online publishing steps, which are identical, including the same three-part technical, security and marketing review before listing on the QuickBooks App Store. Existing QuickBooks Online integrations keep working when a company moves to Intuit Enterprise Suite, so the same security requirements and this check apply.

How is this different from Preflight?

Both check QuickBooks Online apps against Intuit’s published security requirements. Preflight’s free GitHub Action runs six runtime checks on personal accounts; its source-level checks, reports and organization use are in a $49 per month plan, which also offers security-affidavit preparation, 500-connection monitoring and expert triage. The Apideck QuickBooks Review Check is free and MIT licensed for everyone, including companies, runs in the browser as well as in CI, and includes the source checks, extra runtime checks and a PDF report. Details as published by Preflight in October 2026.

Is this tool affiliated with Intuit?

No. It is a free tool from Apideck. Intuit has not endorsed or reviewed it. The requirements it checks are our reading of Intuit’s public documentation, which can change.

What happens to my code when I scan it?

Nothing leaves your browser. The source scan reads the folder you choose inside this tab and runs the same rules locally. No file is uploaded to Apideck.

Does this replace a penetration test?

No. This check looks for known configuration and code patterns. Intuit’s review also tests for XSS, CSRF, injection and access-control flaws that only an active test finds. For that, run a penetration test, for example with Aikido’s AI pentesting. Apideck partners with Aikido: their agents confirm each finding before reporting it, and you get a report within hours.

What does the live scan send to my app?

About 30 ordinary requests: a few GETs, a TRACE, TRACK and OPTIONS request, one call to your OAuth callback with fake parameters, and redirect probes with a harmless test URL, plus four TLS handshakes. Only scan apps you own or are authorized to test.

How is the review different when I connect QuickBooks through Apideck?

You still register your own Intuit app and complete Intuit’s assessment. With Apideck, the OAuth redirect URI, token exchange, token storage and refresh run on Apideck, so those items are no longer code you write and host. Your app’s own HTTPS, cookies, cache headers, CSRF and XSS protection, and how it uses QuickBooks data, stay with you.

Do I need to keep checking after my app is approved?

Intuit reviews listed apps, and apps with more than 500 connections, again over time. Re-run the check after changes to your hosting, headers or OAuth code.

The Embedded Finance Index is live: 6,292 companies and 1,383 providers, mapped across the stack. Explore the Index →

Free and open source (MIT) · for QuickBooks Online apps

QuickBooks app review checkFind security-review blockers before you submit

Check your deployed app and your code against the issues that most often send QuickBooks Online apps back during Intuit's security review. Free, no sign-up, and your code never leaves your browser.

apideck-libraries/quickbooks-review-checkMIT licensed

Try a sample:Code on GitHub

Example report for our insecure sample app

17 failed7 warnings3 passed

Server & transport

Attack vulnerabilities

Cookies & sessions

OAuth token management

Token-endpoint redirect rule

What is the QuickBooks app security review?

It is Intuit's check that a QuickBooks Online app handles customer data and OAuth tokens safely before it can connect to production companies or be listed on the QuickBooks App Store. Reviewers look at transport security, cookies and sessions, common web vulnerabilities, how the app stores OAuth tokens, and how it uses QuickBooks data. Apps for Intuit Enterprise Suite go through the same review.

Apps go through a technical review, a security review and a marketing review before they can be listed on the QuickBooks App Store. The security review starts once the technical review passes.
Critical, high and medium issues found in the security review must be fixed before the app can be published.
Private apps that are not listed still have to complete the app assessment questionnaire once they connect to production QuickBooks Online companies.
Listed apps, and any app with more than 500 connections, are reviewed again at least once a year. Issues found in those reviews must be fixed within two weeks.

How to check your app before you submit

1
Scan the deployed app
Enter your app URL and OAuth callback path. The check probes HTTPS, TLS, cache headers, cookies, HTTP methods and the callback redirect.
2
Scan the source code
Choose your repository folder. It is scanned in the browser for token storage, key handling, logging and CSRF issues.
3
Fix what fails
Open each failed item for the reason and the fix, or read the requirements guide for fixes per stack.
4
Sign off the rest
Confirm the items no scanner can prove, such as data usage and access control, before you submit to Intuit.

What the check covers

Results are grouped by the areas Intuit's reviewers look at. Some are verified from outside, some from your code, and some only you can confirm. The requirements guide explains each one with fixes.

Server and transportAutomated: HTTPS on every page, TLS 1.0 and 1.1 refused, no-store caching on sensitive pages, TRACE disabled, no tokens in logs.
Cookies and sessionsAutomated: Secure and HttpOnly on session cookies, read from your live responses and from cookie settings in your code.
OAuth callbackAutomated: The redirect URI answers with a 302 instead of an HTML page, so the auth code and realmId cannot leak through the Referer header.
OAuth token managementCode patterns: Refresh tokens and realmIds encrypted at rest, keys kept out of source, tokens kept out of the browser.
Attack vulnerabilitiesCode patterns: A fixed OAuth state, missing CSRF protection, open redirects, and SQL, XSS and XXE patterns worth a closer look.
QuickBooks data usageSign-off: Flags code that handles QuickBooks data and also imports LLM, analytics or error-tracking SDKs. The rest is your sign-off.

Need a penetration test too? This check finds configuration and code patterns. Flaws such as broken access control only show up when someone actively attacks the app. Apideck partners with Aikido for this: Aikido's AI pentesting confirms each finding and delivers a report within hours.

Four mistakes that cost a review cycle

Each one is a small fix once you know it matters.

Copying the sample app’s OAuth state

Intuit’s sample code passes a fixed state value. Shipping it turns off CSRF protection on the connect flow.

- authorizeUri({ scope, state: 'testState' })+ authorizeUri({ scope, state: req.session.oauthState })

Using private as the cache header

private still lets the browser store the page. Pages with QuickBooks data or tokens need no-store.

- Cache-Control: private, max-age=0+ Cache-Control: no-store, no-cache, must-revalidate

Rendering a page on the OAuth callback

The callback URL carries the auth code and realmId. Any third-party asset on that page can receive them in the Referer header.

- res.send('<h1>Connected!</h1>')+ res.redirect(302, '/app/connected')

Storing the refresh token as plain text

Encrypt the refresh token and realmId with AES before writing them, and load the key from configuration.

- db.save({ refreshToken: token.refresh_token })+ db.save({ refreshToken: encrypt(token.refresh_token) })

Run it on your machine or in CI

The CLI and GitHub Action run the same checks, plus signed-in pages with a session cookie that never leaves your infrastructure. Run the action on every deploy and on a schedule, so a changed header shows up in CI before Intuit's next review.

Command line

Node 20 or later. Nothing to install.

Terminal

npx

# Live checks plus a scan of the current foldernpx @apideck/quickbooks-review-check \  --url https://app.example.com \  --callback /oauth/callback \  --path /dashboard \  --header "Cookie: session=…" \  --source .

GitHub Action

Listed on the GitHub Marketplace. Store a test-account cookie as the QBRC_SESSION_COOKIE secret.

.github/workflows/quickbooks-review.yml

name: QuickBooks review checkon:  deployment_status:  schedule:    - cron: '0 6 * * 1' # every Mondayjobs:  check:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: apideck-libraries/quickbooks-review-check@v0        with:          url: https://app.example.com          callback: /oauth/callback          paths: /dashboard          headers: |            Cookie: ${{ secrets.QBRC_SESSION_COOKIE }}          source: .

All options on GitHub Install from GitHub Marketplace Package on npm

The part you sign off yourself

Intuit asks about these, and no scanner can prove them. Every downloaded report ends with this list.

0 of 7 confirmed

Shorter review, less to defend

Let Apideck run the QuickBooks OAuth flow and store the tokens.

With Apideck, the redirect URI, token storage and refresh run on Apideck, and the same integration covers Xero, NetSuite and other accounting platforms.

Get started for free Talk to an expert

OS, web server, runtime and dependencies are on current patch levels (e.g. npm audit, Dependabot, base image updates).Every route that reads or writes QuickBooks data enforces authentication and checks the user owns that realmId (no IDOR).A penetration test or DAST scan of signed-in pages (e.g. Aikido AI pentesting or an OWASP ZAP baseline) shows no XSS, CSRF, injection or access-control issues.All database and XML access is parameterized; XML parsers have external entities disabled.No QuickBooks data is sent to analytics, LLM, logging or other third-party services outside the app's stated function.QuickBooks data is retained only as long as needed for the app's function, and deleted on disconnect.Disconnect/revoke flow calls Intuit's revoke endpoint and deletes stored tokens.

How it compares to Preflight

Preflight also checks QuickBooks apps against Intuit's review. Its free action covers the runtime checks on personal accounts; the source checks and reports are in its paid Organization plan. Here everything is free and open source, including for companies. Preflight's paid plan adds affidavit preparation, connection monitoring and expert triage, which this tool does not offer.

Feature	Apideck QuickBooks Review Check	Preflight (free)	Preflight Organization
Price for a company	Free	Personal accounts only	$49 / month
Open source	MIT, scanner and action	MIT, action	Not listed
Run in the browser, no install		Not listed	Not listed
GitHub Action
Command line	npx (Node)	Python script	Not listed
HTTPS, TLS, cache headers, cookie flags, TRACE, 302 callback rule
HSTS, certificate, open redirects, version banners, security headers		Not listed	Not listed
Refresh token and realmId encryption, key storage
Tokens in logs or the browser, constant OAuth state
XSS, injection and CSRF	Code patterns; pentest via Aikido		Scanner-backed, expert-triaged
Report	PDF and Markdown, free	Pass/fail in CI	Audit-ready report
Security-affidavit preparation
500-connection re-review monitoring
Insecure and secure sample apps to try		Not listed	Not listed

Preflight details as published on preflightci.dev and Preflight on GitHub Marketplace on October 28, 2026. “Not listed” means their pages do not say. Preflight is a trademark of its owner; check their site for current plans.

Building on QuickBooks

QuickBooks integration
Data models and coverage for QuickBooks Online through Apideck.
Intuit’s annual QuickBooks security review
Who gets reviewed, what Intuit checks and how to prepare before the vendor emails.
How to integrate with QuickBooks Online
A walkthrough of the QuickBooks Online API and OAuth flow.
QuickBooks API pricing and the Intuit App Partner Program
What the partner tiers and API call limits mean for your app.
Connect QuickBooks through Apideck
Set up your Intuit app with the Apideck redirect URI.
Accounting API
One API for QuickBooks, Xero, NetSuite and more.
Vault
Hosted OAuth, token storage and refresh for every connection.

Frequently asked questions

Last updated October 28, 2026

This tool is provided as is, without warranty of any kind. It is a self-assessment aid and not legal, compliance or security advice. Results do not guarantee that an app meets Intuit's requirements or will be approved. You are responsible for your app's security and for confirming requirements against Intuit's official documentation. Only scan systems you own or are authorized to test.

Not affiliated with, endorsed by or sponsored by Intuit Inc. Intuit and QuickBooks are trademarks of Intuit Inc., used here only to describe what the tool checks against.

Launch accounting integrations in weeks, not months

Get started for free