The short answer
Three systems Pythn Development regularly connects to small-business custom software are QuickBooks for accounting, Stripe for payments, and HubSpot or Salesforce for CRM — each has a production-ready API and typical integration takes 1 to 3 weeks. That range is Pythn's own estimate for one connection, in calendar time rather than full-time effort: a one-way push, such as Stripe payments flowing into QuickBooks Online, sits at the short end; a two-way sync that has to match customers across both systems sits at the long end.
The weeks go to authorization, sandbox testing, deciding which system owns which field, and handling the failures the vendors document: throttling, retries, and duplicate or out-of-order events. Each integration typically adds $2,000 to $5,000 to a project, depending on how well the other system is documented and whether data flows one way or both.
Integration basics: APIs, webhooks, OAuth, and rate limits
APIs and webhooks
An API is how your software reads or writes records in another system. The QuickBooks Online Accounting API uses standard HTTP methods and JSON; Salesforce's REST API gives programmatic access to org data. Webhooks flip the direction: Stripe pushes events to an HTTPS endpoint you register, and QuickBooks Online posts a notification when data changes in a connected company. But webhooks are delivery attempts, not guarantees — events can arrive late, twice, or out of order — so pair them with a periodic check through the API, as Intuit recommends.
OAuth: permission without passwords
OAuth 2.0 is how an owner lets your software into their books or CRM without sharing a password: they approve access from the vendor's own sign-in page. QuickBooks Online uses OAuth 2.0 for sandbox and production alike; Salesforce authorizes REST access through an external client app or a connected app; HubSpot requires OAuth across multiple accounts and uses a static access token for an app installed in one. QuickBooks and HubSpot tokens expire and must be refreshed — a background job, plus an alert for when a person has to reconnect.
Rate limits
Each vendor caps how hard you can hit its API: Stripe, QuickBooks Online, and HubSpot answer with HTTP 429, Salesforce with a limit error. Some caps are fixed; others depend on what the business pays for.
QuickBooks Online: sandbox, authorization, and what the API exposes
First, confirm which QuickBooks the business runs. Intuit's guide to the QuickBooks Online Accounting API notes that it doesn't cover QuickBooks Desktop or payments processing, which Intuit documents separately. Two businesses that both say “we use QuickBooks” can need very different integrations.
What the API exposes
Intuit says its APIs let apps use most customer-facing features in QuickBooks Online: customers, vendors, employees, and accounts; invoices, bills, payments, and refunds; products and services through the Item entity; journal entries; and reports such as profit and loss, general ledger, and cash flow. A few capabilities are premium APIs — Projects and Custom Fields among them — open only to Silver, Gold, and Platinum partners in Intuit's App Partner Program.
Sandbox companies
Every Intuit developer profile comes with a sandbox company: a QuickBooks Online company with sample data that looks and acts like the real thing. You can create up to 10, each active for two years and tied to a region you can't change later. Sample data isn't your data, though, so plan a supervised first run against the real company file.
Authorization and tokens
When the owner approves the connection, your software receives tokens tied to that company. Access tokens are valid for 60 minutes. Refresh tokens have a rolling expiry of 100 days, and if one lapses the owner has to go through the authorization flow again; Intuit also tells apps to store the newest refresh token from every response. It runs unattended for years, so build an alert that tells a person to reconnect QuickBooks.
Throttles and webhooks
Intuit's published throttles are 500 requests per minute per company and 10 per second per company and app; go over and you get an HTTP 429 and advice to wait 60 seconds. Queries return at most 1,000 records per response, so large reads have to page. That matters most when backfilling years of history, which deserves its own step.
QuickBooks webhooks point at what changed rather than carrying the record: each notification names the entity type and event, the record ID, and the company, so your software reads the record back through the API. Intuit's best practices: respond with HTTP 200 within 3 seconds and process on a queue; expect retries stretching to every 6 hours, with later events held until you acknowledge; expect events out of sequence; and run a change data capture call to recover anything missed.
Stripe: the easy one, and why it's still worth doing right
Stripe is the easy one. Sandboxes let you simulate transactions with test values that don't move funds, test cards cover declines, disputes, and refunds, and the Stripe CLI triggers webhook events on demand. The gap is between a demo checkout and a payment flow you can reconcile at month-end, and it's mostly about how you handle events.
- Treat webhooks as the source of truth. Some outcomes arrive asynchronously — Stripe's examples include a customer's bank confirming a payment and a disputed charge — so build on events, not the redirect.
- Verify every event. Stripe signs each webhook and warns that without verification an attacker could send fake events to trigger actions like fulfilling orders.
- Acknowledge first, work second. Stripe says to return a 2xx response before any complex logic, and its own example is returning 200 before marking an invoice paid in your accounting system. That is precisely the Stripe-to-QuickBooks step, and it belongs on a queue.
- Expect retries, duplicates, and odd ordering. In live mode Stripe retries a failed delivery for up to three days with exponential back off; in a sandbox, three times over a few hours. An endpoint can receive the same event more than once, and Stripe doesn't guarantee events arrive in order. Log processed event IDs and skip repeats.
- Send idempotency keys. When your software creates something in Stripe, send an idempotency key: if the connection drops and you retry, Stripe returns the first request's saved result instead of creating a second object. Keys can be pruned once they're at least 24 hours old, so they protect retries, not your own records.
HubSpot and Salesforce: when to use each
If the business already runs one, use it; switching CRMs to simplify an integration is rarely a good trade. What differs for the integration is setup and fine print.
HubSpot
For an integration living in a single HubSpot account, HubSpot's developer platform uses a static auth access token; OAuth is required across multiple accounts. Older private apps are now documented as legacy private apps. Limits depend on the subscription tier: privately distributed apps get a burst limit per app every 10 seconds and a daily limit per account, both higher on Professional and Enterprise than on Free and Starter. The daily limit is shared across all such apps in the account, so a new integration draws on the same allowance as any already running there.
Salesforce
Check the edition first. Salesforce enables API access by default in Enterprise, Performance, Unlimited, and Developer Edition orgs; Professional Edition can add it as an add-on, and an org without API access rejects API requests. Salesforce has also restricted creating connected apps as of Spring '26, recommending external client apps instead. The daily API allocation applies to the whole org rather than per user, and depends on edition and on the number and type of user licenses.
Common pitfalls: retry logic, idempotency, and data mapping
Three failures deserve a line item in any integration scope.
Retry logic
Networks drop, vendors throttle, servers restart. Retries should wait longer between attempts, follow the vendor's guidance — Intuit says to wait 60 seconds after a 429 — and stop after a sensible number of tries, alerting a person instead of looping forever. The reverse matters just as much: when Stripe or QuickBooks retries a webhook to you, your code has to be safe to run twice.
Idempotency
An idempotent operation has the same effect whether it runs once or five times. Stripe builds this in with idempotency keys; across two systems you build it yourself. Keep a record that says “Stripe payment X became QuickBooks payment Y” and check it before writing anything. That one table stops a retried webhook from recording the same payment twice.
Data mapping
This is where most of the calendar time goes. Before any code, decide which system owns each piece of data — the CRM owns contacts and deals, Stripe owns payment status, QuickBooks owns the books — and how records get matched. One customer can be “Smith Plumbing LLC” in QuickBooks, “Smith Plumbing” in HubSpot, and an email address in Stripe. Then learn each vendor's traps. In QuickBooks Online, a full update clears any writable field you leave out, which is why sparse updates are safer for partial changes; values sent in read-only fields are silently overwritten with no error; and customers, vendors, and accounts are deactivated rather than deleted, while deleted transactions can't be recovered.
How Pythn scopes and prices integrations
Integrations go into the written design document alongside screens, workflows, and the data model, and fixed scope and fixed price are agreed before building begins — stage three of the five-stage process.
Each integration typically adds $2,000 to $5,000 to a project. Pythn's typical range for one integration is 1 to 3 weeks: a focused integration between two systems usually takes 1 to 2 weeks, and a full workflow automation across multiple tools runs 4 to 8 weeks. The cost guide explains how integrations move a project between price bands.
Two service lines cover the work. Business Automation & Integration connects existing tools, with error handling, retry logic, observability, and a runbook included. API & Backend Development builds the services underneath, with API docs, integration tests, and a deployment runbook. Clients own the code, the domain, and the data. Every engagement includes 30 days of post-launch support, and because APIs change, maintenance retainers keep a vendor's update from leaving you stuck — our guide to maintenance costs covers what that runs.
Where Finlock fits
Pythn Development is a DBA of Finlock Accounting. When a project needs an accounting layer of its own — ledgers, invoicing, payroll, reporting — it plugs into the Finlock API rather than Pythn rebuilding one. More about the Finlock relationship. Firms can also see what we build on the accounting firms page, or read when custom software is worth building for a firm.
Frequently asked questions
How long does a QuickBooks integration take?
Pythn's typical range is 1 to 3 weeks for the integration itself. A one-way push into QuickBooks Online sits at the short end; a two-way sync with customer matching and a multi-year backfill sits at the long end. Most of it goes to the OAuth connection, sandbox testing, Intuit's throttles, and agreeing with whoever keeps the books on how records should land. If it's part of a larger build, it adds to that project's timeline.
Can I switch CRMs without rebuilding my integration?
Usually without a full rebuild, if it was designed for it. Keep CRM-specific code in one layer that translates between your software's idea of a contact or deal and the CRM's. Switching from HubSpot to Salesforce then means rewriting that layer, remapping fields, setting up the new authorization, and migrating data. If CRM field names are scattered through the codebase, it's closer to a rebuild.
Does this work with QuickBooks Desktop?
Not through the same API. Intuit's QuickBooks Online Accounting API covers QuickBooks Online, and Intuit documents the QuickBooks Desktop API separately, so a Desktop integration needs its own scoping. Mention which product you run when you book a discovery call.
How much does a QuickBooks, Stripe, or CRM integration cost?
Each integration typically adds $2,000 to $5,000 to a project. When the integration is the whole project — a small tool with its own login and admin screen, like Stripe charges flowing into QuickBooks entries — it lands in the $5,000–$15,000 band. The cost calculator will place your project in a band in about a minute.
Who owns the integration once it's built?
You should, and at Pythn you do: clients own the code, the domain, and the data. Also check who owns the accounts behind each connection — the Stripe account, the Intuit developer account holding the QuickBooks app, the HubSpot account, the Salesforce org. Make sure they belong to your business, so a change of developer doesn't mean a broken connection.