Developer Platform: OAuth2, MCP & REST API

Developer platform

Expensicat is now a developer platform. Third-party apps and AI assistants can securely access your financial data through a standards-based integration layer.

OAuth2 authorization

Expensicat now acts as a full OAuth2 authorization server. Third-party applications request access through a consent screen where you control exactly which scopes to grant.

• Granular scopes: read transactions, manage invoices, view projects, and more
• Consent screen: review and optionally deselect scopes before authorizing
• Short-lived tokens: access tokens with automatic refresh for security

MCP server

Connect AI assistants like Claude Desktop directly to your Expensicat workspace via the Model Context Protocol.

Once authorized, AI tools get access to:

• Query expenses: search and filter your transactions
• Create invoices: generate and send invoices through natural language
• View metrics: pull revenue, expense, and cash flow data
• Manage accounts: list bank accounts and balances

REST API and SDK

A comprehensive REST API now covers every resource in Expensicat. Use the first-party SDK for type-safe programmatic access, or build your own integration against the documented endpoints.

Organizations and MFA

A new organization model supports invitations, approvals, and role-based access. Multi-factor authentication adds an extra layer of security to your account.

New 7

• OAuth2OAuth2 authorization server with consent screen and granular scope management
• MCPMCP server, so AI assistants like Claude connect directly to your workspace
• APIFull REST API covering transactions, invoices, customers, projects, bank accounts, categories, time entries, documents, recurring invoices, and more
• APIFirst-party SDK for programmatic access to all API resources
• SecurityMulti-factor authentication (MFA)
• PlatformOrganizations with invitations, approvals, and role-based access
• PlatformSession and app management with short-lived tokens and automatic refresh

Improvements 2

• OAuth2Fine-grained consent screen, so you can review and deselect individual scopes before authorizing
• FilesFile browser UX improvements with better navigation and a document-oriented layout

Fixes 2

• AuthFixed redirect issues during registration and login
• GeneralVarious stability and performance improvements

MCP server 3

• MCPSecure, authenticated MCP server scoped to your organization
• MCP12+ tools available for expenses, invoices, metrics, bank accounts, and more
• MCPToken-based access control with scope enforcement