Quaderno
BUSINESS · COMMERCE & FINANCE
Invoices, receipts, credit notes and tax rates from the account they connected.
Connecting Quaderno in practice
Every Quaderno request goes to an account-specific hostname — ACCOUNT_NAME.quadernoapp.com — which you cannot guess and have to look up by calling /authorization with the key first. The same API returns 401 both for an invalid key and for a permission the user does not have, so an agent cannot tell a bad credential from a forbidden action.
Scopes that draw scrutiny
sk_ secret key (HTTP Basic username, empty password)Quaderno defines no scopes. In its own words, anyone who has the key "can read and modify everything your account has access to", including invoices and customer tax data.publishable_key (pk_…)Returned by /authorization for front-end use, so it is safe to expose — which makes it easy to confuse with the secret key in the same response body.
Rate limits
- 100 API calls per 15 seconds.
- X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (a UTC epoch timestamp) on every successful response; 429 when exceeded.
- GET /api/ping verifies credentials and reports remaining requests without consuming a real API call.
- List pages default to 25 objects and can be raised to 100 with limit.
Worth knowing
- Pagination is a cursor on object id: pass created_before=<id> and follow X-Pages-HasMore and X-Pages-NextPage. There is no page parameter.
- The Sandbox is a separate environment at sandbox-quadernoapp.com with its own credentials, and it caps the account at 200 documents, reported in X-Documents-Limit and X-Documents-Remaining, until you purge.
- In the Sandbox, US tax calculations return state-level rates only except for ZIP codes 90049, 10128, 60611 and 33132, so local-rate logic cannot be tested there.
- The API is versioned by release date (20241028 is current) and a new version ships only for a breaking change, so new fields appear in your existing version without notice.
- Quaderno does not retry or track a failed call, so retry logic is entirely the caller’s job.
Checked against Quaderno API reference (2026-09-29), Sandbox (2026-09-29), Webhooks guide (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Quaderno behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.