OAuth 2.0 bearer access token (scope com.intuit.quickbooks.accounting). Mint it from the Intuit OAuth 2.0 Playground or `quickbooks-cli auth refresh`. Secret.
QUICKBOOKS_BASE_URL
No
Full company-scoped API base, e.g. https://quickbooks.api.intuit.com/v3/company/<realm-id>. Leave blank when you set the realm ID and environment above; the CLI builds this from them.
QUICKBOOKS_CLIENT_ID
No
Client ID of your Intuit app (developer.intuit.com > your app > Keys). Set it with the client secret and refresh token so the CLI can mint a fresh access token; leave blank if you paste an access token instead. Secret.
QUICKBOOKS_CLIENT_SECRET
No
Client secret paired with QUICKBOOKS_CLIENT_ID. Secret.
QUICKBOOKS_ENVIRONMENT
No
Which Intuit host the realm lives on: production or sandbox. Combined with the realm ID to build the base URL.
QUICKBOOKS_REALM_ID
Yes
The QuickBooks company ('realm') ID every call is scoped to. Find it in the Intuit developer dashboard or the sandbox company URL. Without it the CLI cannot build a working base URL.
QUICKBOOKS_REFRESH_TOKEN
No
OAuth 2.0 refresh token. Refresh tokens live ~100 days and rotate on every refresh, so the CLI writes the new one back to its config. Secret.
QUICKBOOKS_TOKEN_URL
No
Token endpoint the client-credentials exchange posts to. Leave the prefilled default unless your tenant uses a different token endpoint.
