Lexware Office
BUSINESS · COMMERCE & FINANCE
Contacts, invoices, quotations, and vouchers in the account they connected.
Connecting Lexware Office in practice
Lexware Office allows a client just 2 requests per second, which makes it one of the slowest accounting APIs to sync against, and every resource carries a `version` field for optimistic locking so a write that sends a stale version is rejected rather than merged. The credential is also minted by the account holder in the app rather than issued to your integration, and the product was renamed from lexoffice, so the old developer domain now redirects.
Scopes that draw scrutiny
API key / access tokenThe documentation uses the two terms interchangeably for one credential, passed as `Authorization: Bearer {accessToken}`. It is generated by a user at app.lexware.de/addons/public-api, so its reach is that user’s account.
Rate limits
- "A client can make up to 2 requests per second to the Lexware API."
- Documented list responses page at 25 items ("size": 25).
Worth knowing
- Every resource has a `version` that increments on each change, and writes use it for optimistic locking — so a read-modify-write agent must carry the version through or lose the update.
- The API key is created by the customer, not by you: onboarding is "ask the account owner to generate a key in the add-ons area", which means no OAuth consent screen and no way to request narrower access.
- developers.lexoffice.io now resolves to developers.lexware.io, so older bookmarks, sample code and any hardcoded documentation links need rewriting after the rename.
- At 2 requests per second a full ledger backfill is measured in hours, so bulk work has to be scheduled rather than run on demand.
Checked against Lexware Public API docs (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Lexware Office behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.