How to connect QuickBooks to Hermes Agent

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.

Reconnect QuickBooks from the dashboard, then start a fresh chat if the runtime still has the old tool catalog loaded.

QuickBooks tool schemas load on demand the first time a tool runs and are cached after that, so this error usually clears on its own: wait a few seconds and retry the same request. If every QuickBooks call keeps failing with it in a fresh chat, reconnect from the dashboard, and contact support if it still persists — that pattern points to a configuration problem on our side, not something you can fix by reconnecting again.

Two usual causes. The connected account may not have access to the specific workspace, inbox, store, or project in the request — check that first. If access looks right, the agent may have sent a placeholder value (like "YOUR_ID" or an example id from documentation) instead of a real one: ask it to run a list or search tool first, then retry the action with a real id from those results. Most failures at this stage are one of these two, not ClawLink bugs.

For a hosted connection the taught cause order is: connected user, company, then credentials. First, the user: a connected account that is not an admin of the company the tool is addressing fails writes, and ChatGPT's p3 diagnosis names non-admin user as the top cause. Second, the company: QuickBooks scopes everything to a company (realm), so a call aimed at the wrong company 403s even with full access, and an agent that guesses "my company" can target the wrong books. Third, stale credentials: a grant made before a permission change keeps its old limits, and disconnect then reconnect with the admin account re-issues it. Only then look at the arguments, where an invented customer or invoice id returns the same permission-shaped error because QuickBooks hides what the connection cannot see.

Ask the agent to diagnose it:

Call quickbooks_get_company_info and tell me which company this connection is acting as. Then call quickbooks_get_customer for the id the failed call used and quote the exact error. Do not retry the failed call yet.

Two different failures. If Hermes shows no QuickBooks tools at all, the connection or the pairing is incomplete: confirm both hermes clawlink begin and hermes clawlink finish ran, that QuickBooks shows as connected in the dashboard, and that you started a fresh chat after connecting. If most tools work and a single name fails, the name is wrong rather than missing, and the error lists the closest real ones. The causes search results teach for this symptom are local-server problems: an offline MCP process, misconfigured environment credentials, or a revoke-and-reauth cycle for a local client. None of those exist here, so ignore advice about restarting processes or editing config files.

Ask the agent to diagnose it:

List the QuickBooks tools you actually have access to. If there are none, say so plainly. If there are, tell me which one creates an invoice and use that exact name.

This is the token-lifecycle failure: the OAuth grant behind the connection was revoked, expired past its refresh, or was revoked inside Intuit's Connected Apps page. Reads and writes fail together from that moment, and nothing about the tool calls will fix it. Reconnect QuickBooks from the dashboard, sign in again on Intuit's screen, and start a fresh chat so Hermes picks the new grant up. If only one tool fails while others work, you are back in 403 territory: wrong company, non-admin user, or a bad id, not a dead connection.

Ask the agent to diagnose it:

Check whether quickbooks_get_company_info succeeds. If it fails, say "connection is dead" and tell me the exact error. If it succeeds, list which tools failed and what ids they were called with.

Try reconnecting QuickBooks and complete the consent flow in the same browser session. Partial OAuth approvals or switching accounts mid-flow can leave the connection incomplete.

Yes. ClawLink is the fastest way to connect Hermes to QuickBooks: link your QuickBooks account once in the browser and Hermes Agent can call the QuickBooks API through 105 ready-made tools — no custom code or token handling.

Install the plugin with hermes plugins install ClawLink-HQ/hermes-plugin --enable, then pair once: run hermes clawlink begin, approve the link in your browser, and run hermes clawlink finish. Connect QuickBooks in the dashboard and Hermes can use it from the next message — no config files or API keys to manage.

About two minutes. Sign in, click Connect next to QuickBooks in the dashboard, authenticate, and Hermes Agent can use it from the next chat message.

The alternative to ClawLink is usually manual OAuth app setup plus your own token handling, permission troubleshooting, and tool plumbing for Hermes Agent. That is fine if you want to build and maintain the integration yourself. Most teams just want QuickBooks working from chat.

No, and this is the question the page exists to answer. The developer-app route is what most guides teach because the alternatives require you to own an OAuth app: register in the Intuit Developer portal, request the accounting scope, build a token refresh cycle, and keep it running. ClawLink owns a verified app, so the developer portal, the scope request, and the refresh cycle are all removed. You approve Intuit's consent screen once, and the connection refreshes itself server-side. The search-results story that "without your own developer app" is hard is about every route except this one.

The tools divide into the objects and the reports. Objects: create and read invoices, customers, bills, credit memos, deposits, estimates, employees, accounts, bank accounts, items, and journal entries, and read the PDFs of invoices and estimates. Reports: balance sheet, general ledger, aged receivables, customer balances, inventory valuation, and company info. The writes land in your real books, so invoice and bill creation are the actions to be deliberate about; reports are read-only and safe to let an agent explore freely.

No. Intuit now answers "QuickBooks AI agent without API key" with its own native agents: Accounting, Finance, and Customer agents inside QuickBooks itself. They are built-in product features. This integration is the external-agent route: Hermes is the agent, and QuickBooks is one connected account among several. If you want an agent that lives entirely inside QuickBooks, the native agents exist; if you want your own agent working across your tools, this is the route that connects it to the books.

The one you sign in with, and this is a common failure point worth understanding before it happens. A QuickBooks sign-in that manages several companies attaches to whichever one you pick, and an agent told "my company" without context may be looking at the wrong books. The 403 causes engines teach for connected accounts are exactly this family: the connected user lacks access to the company the tool is targeting, the account is not an admin of that company, or the connection predates a permission change. Reconnecting from the dashboard and signing in with an account that is an admin of the right company is the fix.

The risk conversation engines have about this is real: financial data, token compromise, and who is a data processor. The mechanics of this connection are the mitigations: the OAuth token lives server-side rather than in a config file or environment variable, the tool table on this page is the complete set of operations the agent can invoke, and revoking from the dashboard cuts access immediately. Keep the human-in-the-loop habit for writes: draft invoices and bills for approval before posting, and use the read-only report tools for anything exploratory.

Pairing is a two-step handshake: run hermes clawlink begin, approve the link in your browser, then run hermes clawlink finish. If you ran finish before approving, or the approval link expired, run hermes clawlink begin again to get a fresh link. Confirm the plugin was installed with --enable, then verify with hermes clawlink test.