Skip to main content
This section describes how an integration establishes and maintains a secure connection between Pleo and the target accounting system. Connection and authorisation cover authentication, credential management, and correct entity association. Together, these ensure that data is exchanged securely, reliably, and with the correct company.

​
Authentication Methods

Integrations may authenticate using:
  • OAuth 2.0 – recommended for systems that support standard OAuth 2.0 flows.
  • API keys – suitable for systems with constraints that prevent OAuth 2.0.
Regardless of the method, authentication must support long-lived operation without repeated user intervention.

​
Credential Lifecycle Management

Credentials must be stored securely and managed throughout their lifecycle. This includes:
  • Refreshing credentials before they expire
  • Handling revocation or invalid credentials
  • Ensuring uninterrupted operation during normal use
For OAuth 2.0 integrations, see the Tokens Overview and related token lifecycle guides for detailed best practices.

​
Secure Storage

All credentials, including access tokens, refresh tokens, and API keys, must be stored securely to prevent accidental exposure or misuse. Follow the secure storage patterns defined for both OAuth 2.0 and API key–based integrations:
  • For frontend clients (SPAs, mobile apps): use HTTP-only cookies or encrypted key stores
  • Avoid insecure locations such as local storage or client-side plain text

​
Entity Association

Each integration represents a one-to-one connection between a Pleo entity and a company in the accounting system. Correct entity association is essential to ensure all exported and synchronised data is recorded in the appropriate accounts, as defined by the Multi-Entity model.

​
Reliability and Failure Handling

Integrations must handle authorisation failures gracefully, including:
  • Expired credentials
  • Revoked access
  • Transient connectivity issues
Provide clear feedback to users when re-authentication is required, and implement mechanisms to automatically recover when possible. OAuth 2.0 integrations should implement centralised token refresh and race condition prevention to maintain continuous operation.