Exchange a QuickBooks Online OAuth 2.0 authorization code for access and refresh tokens

In-depth guide

Documented steps

1. Register your app in the Intuit Developer portal and get a client_id and client_secret from Keys & OAuth (Production or Development section).
2. Send the user through the authorization URL; on approval Intuit redirects to your redirect_uri with a one-time 'code' query parameter.
3. POST to the token endpoint https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer with Content-Type: application/x-www-form-urlencoded.
4. Authenticate with HTTP Basic auth: 'Authorization: Basic ' + base64(client_id + ':' + client_secret).
5. Body: grant_type=authorization_code, code=<the code>, redirect_uri=<your registered redirect URI>.
6. Parse the JSON response; capture access_token, refresh_token, expires_in (starts 3600), and x_refresh_token_expires_in.
7. Store access_token and refresh_token in a secure place before the console moves on.
8. For the 5-year hard-expiry field, send header x-include-refresh-token-hard-expires-in: true to receive x_refresh_token_hard_expires_in.
9. API docs: https://developer.intuit.com/app/developer/qbo/docs/develop/authentication-and-authorization/oauth-2.0