Connecting Moneybird: the scope you grant decides what can be seen
This integration is on request too: nothing is sitting ready, there is no app to install, and we hold no partner status with Moneybird. What this page does do is describe the three dials that matter with Moneybird — the type of key, the scopes and the call rhythm — so that in an intake call you know what you are agreeing to rather than what you are ticking. The choices below cannot be adjusted afterwards without re-authorising the integration.
Published on
Does this integration already exist?
Status of this integration: on request. There is no Moneybird integration running that we switch on for you, and no settings screen in which you tick it. What it should actually do comes out of the intake call; after that it is construction work, with a lead time we state up front. Until that call has happened, any promise about what it can do is an assumption.
What the rest of the site says about this, it says consistently: integrations are custom work and follow the intake call. What an AI colleague does do today is handle email and WhatsApp Business. So everything below describes what an integration would require, not something sitting ready.
What the Moneybird API bounds, and where the brake sits
| Dial | What Moneybird documents about it |
|---|---|
| Two ways of signing in | A registered OAuth application, or a personal API token you send as a Bearer token |
| Reach of that token | Moneybird calls it similar to a password and says it gives access to the entire company account |
| Retrieving contacts | Requires sales_invoices, documents, estimates, bank or settings; time_entries alone is not enough |
| Call limit | 150 requests per 5 minutes per IP address, and 50 per 5 minutes on the reporting endpoints |
| Available from Novot AI? | On request — nothing has been built and we hold no partner status |
A personal token or an OAuth application is not a matter of technical taste
Moneybird offers two ways in. The first is a personal API token you send as a Bearer token; the second is a registered OAuth application. About the first, Moneybird itself writes that you must store it securely, because it is similar to a password and gives access to your entire company account. That is not small print but the heart of the difference.
That difference decides what happens when someone leaves or a key leaks. A personal token hangs on a person and on that person’s rights: withdraw the account and the integration falls over. With an OAuth application, Moneybird creates a separate API user, and actions are named after the registered application. When you are working out afterwards what happened, that is the difference between "someone changed this" and a name you can ask.
Scopes: what you do not grant cannot come out
Moneybird divides access into scopes: sales_invoices, documents, estimates, bank, time_entries and settings. If all you want is invoice lookups, there is no need to grant the bank scope. That is not just tidy, it is the cheapest way to limit the damage of a leaked key: what the key is not allowed to reach does not come out, even if it ends up in the wrong hands.
There is one catch that surprises people during setup. Contacts have no scope of their own: Moneybird writes that you need sales_invoices, documents, estimates, bank or settings to reach contacts within the API, and that having only time_entries will not get you there. So anyone thinking "we will only open up time tracking" while still expecting customer names is in for a disappointment — or grants a broader scope after all, which is exactly the wrong reason to open something up.
That is why we fix the scope choice before anything is built rather than after. It is the one place in this whole story where a single line decides what an integration can ever see, and it is a line you do not quietly adjust later: a broader scope means re-authorising, with your signature under it.
A hundred and fifty requests per five minutes, and why it counts per IP address
Moneybird states that use of the API is unlimited within the subscription and permissions of the account you are working with, but that requests are throttled per IP address to prevent fraud and abuse: 150 times per five minutes, and 50 times per five minutes on all reporting endpoints. Exceed it and you get a 429 back, with a Retry-After header attached.
Per IP address, not per administration — that is the sting. If your integration, an invoicing tool and a dashboard all run from the same address, they share those 150 between them. For answering customer questions that is generous: those are individual lookups, not an export run. For the first full read of an existing administration it is tight, and that is exactly when you notice it — during the build, not in daily use.
What you need at hand before the scope choice can be made
- The administration ID of the Moneybird environment involved, and whether there is one or several.
- A decision on the scopes: which parts an AI colleague may consult, and which deliberately not.
- Who manages the key and where it is kept — a personal token passed around in a chat message is no longer a key.
- The lookups you currently perform in Moneybird yourself in order to answer a customer. Without that list, any integration is guesswork.
How we get from a first conversation to something that works is described in our approach. What stays on this page is the order that matters most with Moneybird: scope first, type of key second, functionality last. Reverse that order and you build something handsome first, only to discover it works solely with a key that opens the entire company account.
What applies legally once an integration pulls personal data out of a package — retrieve no more than you need, and record who the controller is — is set out in AI and the GDPR for SMEs. Which channels an AI colleague serves with us is covered on the channel page about email.