Exact Online

Getting a token

1. Register an app in the Exact Online App Centre for your country (apps.exactonline.com). You receive a client id and client secret.
2. Run the authorization-code flow once against your country's host. Keep the refresh token — Exact's access tokens last ten minutes, so the refresh token is the only value worth storing.
3. Set EXACT_CLIENT_ID, EXACT_CLIENT_SECRET, EXACT_REFRESH_TOKEN, EXACT_BASE_HOST and EXACT_DIVISION.

The host is country-specific. start.exactonline.nl for the Netherlands, .be for Belgium, .de for Germany, .co.uk, .fr, .es, .com for the US. A token issued on one host does not work on another, and this is the most common cause of a 401 that looks like a bad secret. Set EXACT_BASE_HOST to the one your customer is on, hostname only.

Division is the administration id, a number. One Exact account can hold dozens of administrations and every data path carries one. exact_online_get_me returns CurrentDivision — use it to find the right value for EXACT_DIVISION.

Rate limits are strict and enforced per app. Exact allows on the order of 60 calls a minute and a few thousand a day. The response headers carry the remaining budget. Bulk work needs pacing, not retrying.

OData v3-flavoured. $select, $filter, $top, $orderby, $expand all work. $filter uses single quotes for strings and datetime'2026-01-01' for dates. Always $select — Exact entities have very many columns.

Cloud reachability: the Exact hosts are public with valid certificates.