Connecting bexio to your tools, what its interface really documents

bexio's REST 2.0 interface, read before being plugged in

The interface is called from a single root, https://api.bexio.com/2.0/, and exchanges JSON. Authentication follows OAuth 2.0 with OpenID Connect, on the authorisation domain https://auth.bexio.com/realms/bexio, in an Authorization Code flow then Refresh Token when an application acts on behalf of a user. For a bridge running alone on a server, the vendor's documentation, read on 23 August 2026, also describes personal access tokens. The two routes do not open the same path, and the choice is made before the first line of code.

That choice has concrete consequences. A personal token is attached to a user of the bexio account and suits a server-to-server link concerning a single company. The Authorization Code flow suits an application meant to serve several bexio accounts, each giving its consent on its own side. The public documentation describes both, as well as the token refresh mechanics, which allows the work to be estimated before committing.

A detail that matters over time: the version number sits in the interface's root itself. A bridge is therefore written against a named version, and not against an anonymous address that could move without warning. It is the kind of point you note at design time and reread three years later, when nobody in the company remembers who built what.

Scopes describe, object by object, what the bridge is allowed to see

bexio breaks an application's rights into granular scopes, one per object and per level of action. The documentation names for instance contact_show for reading contacts, kb_invoice_edit for writing on invoices, project_show for projects. A well-designed bridge asks only for what it needs, and that request can be reread later, in plain words, on the day a question arises about what an automated process may have changed in the file.

It is also the first arbitration of an integration project. A read-only link to a dashboard does not call for the same scopes as an automated process creating invoices from an online shop. Widening the scope later touches the authorisation itself, and so the approval by the person who holds the account. Better to draw up the list at the framing stage, with the reason for each line.

Five hundred items per request, and a rate limit to be measured

The documentation announces a pagination capped at 500 items per request and a rate limit applied to calls. The first figure sizes any data migration. A base of several thousand contacts, items or invoices is read back in slices, with a cursor held on the integrator's side, and that slicing recurs in every later resynchronisation, not only on the day of going live.

The second figure appears nowhere as a threshold in the pages read on 23 August 2026. It is established under real conditions, on the account concerned, by observing how calls behave as the cadence rises. A serious project therefore starts with a measurement rather than with a hypothesis, and the cadence chosen is written into the acceptance test, with the course of action when the interface refuses a call.

Without a documented webhook, data freshness becomes a setting

The public documentation read on 23 August 2026 contains no section devoted to webhooks or to an event mechanism. Any synchronisation with another tool is therefore built as periodic polling. The sensitive point is not the richness of the interface, it is the cadence at which one decides to question it.

That constraint can be handled. On the integrator's side you keep track of what has already been seen, you replay calls without creating duplicates when an execution breaks off halfway, and you choose a different frequency per object. An item catalogue does not move at the same rhythm as an invoice journal. Designing that mechanism represents a real share of the work, and it deserves to be described in black and white before the order.

There is a consequence visible to users. An invoice created in the shop does not appear in bexio the same second, it appears at the next cycle. That delay is chosen, documented and shown to the people concerned, rather than discovered on a Monday morning by the bookkeeper looking for a document. It is a management decision as much as a technical parameter.

Not everything goes through the interface, and some flows have their own channel

For the initial migration, bexio documents imports through Excel or CSV files for contacts, products and the chart of accounts, described in help articles 000001781 and 000001598. A limit of 15'000 lines is reported for the product import. That channel often remains the shortest way to load an existing base, the interface then taking over for the daily life of the data.

On the bank side, the retrieval of account and transaction data goes through bLink, SIX's platform. Payments from bexio belong to bexio Pay, charged at CHF 14.00 per month and included in the Ultimate package. Salaries go out through Swissdec to the insurers and the authorities, the product bexio Lohnbuchhaltung appearing in the official register in ELM 5.0, 5.1 and 5.3 under certificate No. 1142.24. The QR-bill, for its part, is generated natively.

Two flows deserve a prior check. Sending invoices into the recipient's e-banking through eBill goes through a third-party Marketplace application, eBill from iomarket AG, charged on top. And bexio does not figure in the OpenPeppol list of Certified Service Providers, updated on 21 August 2026. A company that must invoice a principal requiring Peppol looks elsewhere for that particular channel, and knows it before signing.

The Marketplace covers a known case, a bridge covers yours

bexio's Marketplace announces more than a hundred applications, from online commerce to document management. When a published application matches the need exactly, it is the shortest path, and it is tested before any development. Bespoke work starts elsewhere, where customer identifiers must be matched between two systems, a rule specific to the house applied, or an internal trade tool connected that nobody else uses.

A bridge needs an access to the account, and that access is counted. The packages published on 23 August 2026 include a fixed number of users, and the price of an additional access is published for some of them. The arbitration arises at the moment of deciding whether the automated process works under a dedicated technical account, which makes the traces legible, or under a person's account, which mixes them with that person's daily work.

Between the two options, the useful criterion is lifespan. A Marketplace application is a contract with a third party, with its own rhythm of updates and its own support. A bridge written for the company follows the scopes and the cadence set for it, and its code belongs to the file. Both are justifiable, and the choice arises flow by flow, not once and for all.

The data's way out is prepared on the day you go in

The vendor's help documents exports in PDF and in Excel as well as a backup function. No complete export of the database as a single file is documented in the pages read on 23 August 2026. In that context, the interface itself becomes a means of reading back, and the scopes granted to the bridge determine what it can actually retrieve. The question arises at the start of a project, not on the day one wishes to leave.

One last useful marker. bexio's official partner programme addresses fiduciaries, the public directory announcing more than 1'000 fiduciary companies and statuses ranging from Silver to Platinum. For the technical part, the company relies on the public documentation and on whoever knows how to read it. We sell no licences.

• The objects to synchronise, and the direction each one travels
• The strictly necessary scopes, read and write separated
• The access route chosen, personal token or full OAuth flow
• The polling cadence, measured on the real account before being fixed
• The account the bridge works under, and what it costs
• What must be able to come back out one day, and through which channel

Where these answers come from

Every fact on this page can be checked at the source. The links open directly the website of the vendor or body concerned.

• bexio, plans and pricesNames and prices of the four packages, users included and price of an additional access, read on 23.08.2026
• bexio interface documentationRoot api.bexio.com/2.0, OAuth 2.0 and OpenID Connect, personal access tokens, scopes, pagination at 500, rate limiting, no webhook section
• bexio, the QR-billNative generation of the Swiss QR-bill and reconciliation of payments
• bexio, electronic invoicingeBill through the third-party iomarket AG application on the Marketplace, charged on top
• Swissdec register of certified softwarebexio Lohnbuchhaltung certified ELM 5.0, 5.1 and 5.3, certificate No. 1142.24
• OpenPeppol list of Certified Service ProvidersList updated on 21.08.2026, with no bexio entry
• bexio's privacy policyCustomers' personal data stored and processed exclusively in Switzerland, servers located in Switzerland
• bexio's release of 18 February 2026100'000 customers, 100 % subsidiary of Mobiliar, new packages from March 2026
• inside-it, bexio announces 100'000 customersPerspective from the Swiss IT press, Swiss21 over 80'000 and KLARA 50'000
• Directory of bexio's fiduciary partnersPartner programme reserved for fiduciaries, more than 1'000 companies listed, statuses from Silver to Platinum
• inside-it, Mobiliar takes over bexioAnnouncement of the purchase on 05.07.2018, 100 % of the shares

SURVEY OF 23.08.2026

Frequently asked questions