Runs only on the owner's computer
Connection credentials, OAuth tokens, company identifiers, and financial data are not entered into or hosted by this site. There are no action buttons here and this page does not call localhost, detect status, or receive an OAuth callback.
Initial connection
After loading the approved private Production configuration into the local process, the owner runs:
.\.venv\Scripts\python.exe -m financial_ops qbo-connect --environment production --approve-production-companyThe local control opens Intuit in the owner's browser, validates OAuth state, verifies the independently configured realm and exact Company Name through CompanyInfo, and only then stores encrypted tokens. The Production authorization URL is not printed.
Reconnect
After a confirmed disconnect, or when an expired or revoked authorization produces an invalid grant, the local control blocks retrieval and directs the owner to run:
.\.venv\Scripts\python.exe -m financial_ops qbo-reconnect --environment production --approve-production-companyReconnect uses the same verified OAuth flow. It cannot proceed while a token revocation is unresolved, and it does not bypass company verification.
Separate Production callback
Production OAuth still requires one exact registered HTTPS redirect ending in /qbo/callback. That callback is separate from this static site. It must forward only to the localhost listener while authorization is active and must not expose reports, tokens, storage, files, or administration.
Contact
Thomas FinOps is operated by Thomas Barcier. Questions may be sent to thomas@thomasbarcier.com.