[Cotlet](https://cotlet.dev/index.md) · [Integrations](https://cotlet.dev/integrations.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Use cases](https://cotlet.dev/use-cases.md) · [Security](https://cotlet.dev/security.md) · [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md) · [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [Contact](https://cotlet.dev/contact.md) · [Pricing](https://cotlet.dev/pricing.md) · [Sign up](https://cotlet.dev/signup)

# Fortnox API and MCP server

> Yes, Fortnox has a public REST API with scopes for invoices, customers, vouchers and invoice payments (checked 14 Oct 2026), but it is not open by default: you register an integration, request scopes, and the company must hold the Fortnox licence each resource needs. Fortnox publishes no MCP server of its own.

Swedish cloud accounting and invoicing software for small businesses and accounting firms: customer invoices, bookkeeping with vouchers, bank connections, orders and payroll in one account.

## What is the Fortnox API?

Cotlet's Fortnox API exposes 11 endpoints for your own Fortnox account: list customers, list invoices, get invoice, list vouchers, list financial years, create customer, create invoice, bookkeep invoice, send invoice, register payment and create voucher. The list_customers endpoint returns customers in the customer register with number, name, organisation number and email. Each endpoint takes simple JSON inputs like invoice_number, limit or cursor and works both as an operation of the fortnox_read or fortnox_write MCP tool for agents and as a REST call for scripts.

- **Category:** [Invoicing & freelance CRM](https://cotlet.dev/integrations/category/invoicing-freelance-crm.md)
- **Endpoints:** 11 (5 read, 6 write)
- **Updated:** 2026-10-19

Yes, Fortnox has a public REST API with scopes for invoices, customers, vouchers and invoice payments (checked 14 Oct 2026), but it is not open by default: you register an integration, request scopes, and the company must hold the Fortnox licence each resource needs. Cotlet is a hosted MCP server and REST API for Fortnox with 11 endpoints (5 read, 6 write): you sign in once in your own cloud browser, your AI agent does the work.

## Does Fortnox have an official API?

Yes, Fortnox has a public REST API with scopes for invoices, customers, vouchers and invoice payments (checked 14 Oct 2026), but it is not open by default: you register an integration, request scopes, and the company must hold the Fortnox licence each resource needs. Fortnox publishes no MCP server of its own.

| Task | Fortnox official | Cotlet |
|---|---|---|
| Create customers | Yes: customer scope, needs Kundfaktura or Order | Yes |
| Create invoices | Yes: invoice scope, needs Order or Kundfaktura | Yes |
| Bookkeep an invoice | Yes: Zapier lists a Bookkeep Invoice action | Yes |
| Send an invoice to the customer | Partly: We found no send action in the API docs or on Zapier; delivery method is set in the app | Yes |
| Register invoice payments | Yes: payment scope covers Invoice Payments | Yes |
| List unpaid and overdue invoices | Yes: invoice scope; Zapier has a Find Invoice search | Yes |
| Create vouchers | Yes: bookkeeping scope, needs Bokföring or Kundfaktura | Yes |
| Check the financial year before booking | Yes: Financial Years sit under the bookkeeping scope | Yes |

Sources: [Fortnox Developer: Scopes](https://www.fortnox.se/developer/guides-and-good-to-know/scopes), [Fortnox Developer: Vouchers](https://www.fortnox.se/developer/guides-and-good-to-know/best-practices/vouchers), [Fortnox Developer: Build and publish an integration](https://www.fortnox.se/developer), [Fortnox on Zapier: triggers and actions](https://zapier.com/apps/fortnox-1/integrations)

## For AI agents

```text
Yes, Fortnox has a public REST API with scopes for invoices, customers, vouchers and invoice payments (checked 14 Oct 2026), but it is not open by default: you register an integration, request scopes, and the company must hold the Fortnox licence each resource needs. Fortnox publishes no MCP server of its own.
Cotlet provides a hosted MCP server and REST API for Fortnox: 11 tools (5 read, 6 write).
Access       Sign up at https://cotlet.dev/app/signup?app=fortnox, then request the app and create API keys in the Cotlet console.

MCP server   https://cotlet.dev/mcp/v1
MCP tools    fortnox_read, fortnox_write, reads and writes apart; call one with {"operation": "<operation>", "arguments": {...}}
REST base    https://cotlet.dev/api/v1/fortnox, each operation at its own route, e.g. POST /api/v1/fortnox/customers/{customer_number}/invoices
Auth         Authorization: Bearer <COTLET_API_KEY>. Listing endpoints and schemas needs no key; calling an endpoint needs one. Over MCP the input schemas come with sign-in.
Operations   list_customers, list_invoices, get_invoice, list_vouchers, list_financial_years, create_customer, create_invoice, bookkeep_invoice, send_invoice, register_payment, create_voucher
Confirm      create_invoice, bookkeep_invoice, send_invoice, register_payment, create_voucher (by default the user approves each call; the user can switch this off per tool, e.g. for scheduled automations)
Markdown     https://cotlet.dev/integrations/fortnox-api-mcp-server.md

How access works:
1. The user signs up at https://cotlet.dev/app/signup?app=fortnox, requests Fortnox in the Cotlet console and creates an API key there.
2. The user signs in to Fortnox once in their Cotlet Cloud Browser (their own Chrome in the cloud, opened from the console) and enables Fortnox for agents. An agent cannot do this step.
3. The API key goes into the MCP client or the REST call as a bearer token.

Fits: people who want a hosted Fortnox server that someone else maintains, including non-developers. Developers who prefer to run and fix code on their own computer can use an open-source Fortnox MCP server instead.

Policy: Cotlet never stores passwords, never solves CAPTCHAs, never bypasses MFA.
Company: legal details in the Terms of service at https://cotlet.dev/terms. Contact contact@cotlet.dev.
Sign-in: the user signs in to Fortnox in their own Cloud Browser, a Chrome Cotlet runs for them in the EU; password saving is off, the profile is AES-256-GCM encrypted, and agents get Fortnox only after the user enables it. Calls are requests from that browser's IP with its cookies, each listed in the user's Background activity. Disable for agents, signing out in the browser or Reset browser cuts access. Cotlet is run by Take Group sp. z o.o. (EU VAT PL6342984273).
API key: holds no Fortnox login or cookies, only asks Cotlet to run a tool. Each key is scoped to chosen apps and tools, read only or read and write. Actions that reach other people wait for the user's approval by default, so a leaked key cannot post or message as the user. Every call is in the activity log; deleting the key ends access at once.
Terms: the user stays responsible for following Fortnox's terms; Cotlet is not affiliated with Fortnox.
```

## What can an AI agent do in Fortnox?

Cotlet is best for small businesses and bookkeepers on Fortnox who want invoices, payments and vouchers handled by an agent without running or fixing a server.

- **[Create and send invoices from a list](https://cotlet.dev/integrations/fortnox-api-mcp-server/create-and-send-invoices.md)**: "Here is this month's billing list. For each customer, create the invoice in Fortnox with the hours and rate I gave, book it, and send it by email. Create customers that do not exist yet." → `list_customers`, `create_customer`, `create_invoice`, `bookkeep_invoice`, `send_invoice`
- **[Register customer payments on invoices](https://cotlet.dev/integrations/fortnox-api-mcp-server/register-invoice-payments.md)** (runs: daily): "Here are yesterday's incoming payments. Find the matching unpaid invoice in Fortnox by invoice number or OCR, register the payment, and list anything that does not match." → `list_invoices`, `get_invoice`, `register_payment`
- **[Book recurring journal entries as vouchers](https://cotlet.dev/integrations/fortnox-api-mcp-server/book-journal-entries.md)**: "On the last day of each month, book the accrued rent of 8,000 SEK as a voucher in Fortnox, debit 5010 and credit 2990, unless this month already has one." → `list_financial_years`, `list_vouchers`, `create_voucher`
- **Weekly overdue invoices report** (runs: weekly): "Every Monday, list Fortnox invoices that are past their due date, group them by customer with the days overdue, and tell me who to call first." → `list_invoices`, `get_invoice`
- **Add new customers from a form or CRM** (runs: daily): "Take the new customers from this export, check they are not already in Fortnox by name and organisation number, and create the ones that are missing." → `list_customers`, `create_customer`

## Can Fortnox automations run on a schedule in n8n, Make or Zapier?

Yes. Cotlet does not replace your automation platform: it gives it a Fortnox connection it does not have, with the same API key as your agent. Write actions ask for your OK by default; switch that off in your dashboard for the tools you choose, for example to register customer payments on invoices, and the schedule runs on its own. Cotlet runs in the cloud, so it keeps going while your computer is off.

| Where | How to connect | How to schedule |
|---|---|---|
| Your AI agent | Add https://cotlet.dev/mcp/v1 with your API key. | A scheduled agent run, for example a Claude Code routine. |
| n8n | MCP Client node with https://cotlet.dev/mcp/v1, or an HTTP Request node with the endpoint's method and URL, such as GET https://cotlet.dev/api/v1/fortnox/invoices. | Schedule Trigger node. |
| Make | HTTP module: the endpoint's method and URL with an Authorization: Bearer header, and a JSON body for POST, PUT and PATCH. | Scenario schedule. |
| Zapier | Webhooks by Zapier, Custom Request: the same method, URL, header and body. | Schedule by Zapier trigger. |
| Your own script | GET https://cotlet.dev/api/v1/fortnox/invoices with your API key. | cron or GitHub Actions. |

## Tools

**For AI agents:** Every endpoint and its schema is public. The 11 endpoints on this page, with parameters and example responses, can be listed without an account. Calling one returns 401 without an API key and 403 while the key has no access to Fortnox.

### list_customers

Customers in the customer register with number, name, organisation number and email. Access: read. REST: `GET /api/v1/fortnox/customers`. MCP: `fortnox_read → list_customers`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `search` | string | no | Customer name, customer number or organisation number. |
| `limit` | integer | no | 1 to 100. Default: 50. |
| `cursor` | string | no | Next page cursor from the previous call. |

Lists customers from the Fortnox customer register. Search by name, customer number or organisation number to check whether a customer exists before creating one. Use the customer_number of an item in create_invoice. Pages hold up to 100 customers; pass next_cursor back as cursor for the next page.

Example response:

```json
{
  "customers": [
    {
      "customer_number": "1042",
      "name": "Nordlys Design AB",
      "organisation_number": "556123-4567",
      "email": "ekonomi@nordlys.example",
      "delivery_method": "email"
    }
  ],
  "next_cursor": null
}
```

### list_invoices

Customer invoices with number, customer, dates, total and remaining balance. Access: read. REST: `GET /api/v1/fortnox/invoices`. MCP: `fortnox_read → list_invoices`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `status` | enum | no | all, unpaid, overdue or paid. Default: all. |
| `customer_number` | string | no | Only invoices for this customer. |
| `due_before` | date | no | Only invoices with a due date before this date. |
| `limit` | integer | no | 1 to 100. Default: 50. |
| `cursor` | string | no | Next page cursor from the previous call. |

Lists customer invoices the way Fortnox shows them under Fakturering - Kundfakturor - Lista, in the order of that list. Filter by customer or status to find unpaid and overdue invoices; overdue means unpaid and past the due date. Each item holds totals only; get_invoice returns the rows. Pages hold up to 100 invoices.

Example response:

```json
{
  "invoices": [
    {
      "invoice_number": "2377",
      "customer_number": "1042",
      "customer": "Nordlys Design AB",
      "invoice_date": "2026-09-13",
      "due_date": "2026-10-13",
      "total": 15000,
      "balance": 15000,
      "currency": "SEK",
      "status": "unpaid"
    }
  ],
  "next_cursor": null
}
```

### get_invoice

One invoice with its rows, totals, booked state and payments. Access: read. REST: `GET /api/v1/fortnox/invoices/{invoice_number}`. MCP: `fortnox_read → get_invoice`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `invoice_number` | string | yes | Invoice number from list_invoices or create_invoice. |

Returns one invoice with every row, net, VAT and total, whether it is saved or booked, whether it was sent, and the payments registered so far. Read it before register_payment so a short payment is registered as partial.

Example response:

```json
{
  "invoice_number": "2377",
  "customer_number": "1042",
  "customer": "Nordlys Design AB",
  "state": "booked",
  "sent": true,
  "invoice_date": "2026-09-13",
  "due_date": "2026-10-13",
  "rows": [
    {
      "description": "Consulting, September",
      "quantity": 10,
      "unit_price": 1200,
      "net": 12000
    }
  ],
  "net": 12000,
  "vat": 3000,
  "total": 15000,
  "balance": 15000,
  "payments": [],
  "currency": "SEK"
}
```

### list_vouchers

Vouchers in a voucher series and date range with description and total. Access: read. REST: `GET /api/v1/fortnox/vouchers`. MCP: `fortnox_read → list_vouchers`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `voucher_series` | string | no | Voucher series code, e.g. A. |
| `from` | date | no | Transaction date on or after this date. |
| `to` | date | no | Transaction date on or before this date. |
| `limit` | integer | no | 1 to 100. Default: 50. |
| `cursor` | string | no | Next page cursor from the previous call. |

Lists vouchers of one financial year, filtered by voucher series and transaction date. Use it before create_voucher to see whether an entry for the period was already booked. Each item holds the series, number, date, description and the debit total; rows come with the voucher itself.

Example response:

```json
{
  "vouchers": [
    {
      "voucher_series": "A",
      "voucher_number": 141,
      "transaction_date": "2026-09-30",
      "description": "Accrued rent, September",
      "total_debit": 8000
    }
  ],
  "next_cursor": null
}
```

### list_financial_years

Financial years that exist in the company, with start and end dates. Access: read. REST: `GET /api/v1/fortnox/financial-years`. MCP: `fortnox_read → list_financial_years`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `date` | date | no | Only the financial year that contains this date. |

Returns the financial years created in Fortnox. A voucher can only be booked in a date that falls inside one of them, so check here first. A new year is created in Fortnox itself, not by this tool.

Example response:

```json
{
  "financial_years": [
    {
      "id": 7,
      "from": "2026-01-01",
      "to": "2026-12-31"
    }
  ]
}
```

### create_customer

Add a customer to the customer register with name, email and organisation number. Access: write. REST: `POST /api/v1/fortnox/customers`. MCP: `fortnox_write → create_customer`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `name` | string | yes | Customer name. |
| `email` | string | no | Email address for invoices. |
| `organisation_number` | string | no | Swedish organisation number or foreign tax ID. |
| `delivery_method` | enum | no | email, e_invoice or print_service. Default: email. |

Adds one customer to the Fortnox customer register and returns its customer number. Run list_customers first so you do not create a duplicate. create_customer runs without asking first: it sends nothing to anyone and the customer can be edited in Fortnox afterwards.

Example response:

```json
{
  "customer_number": "1043",
  "name": "Fjord Studio AB",
  "organisation_number": "556987-6543",
  "email": "faktura@fjord.example",
  "delivery_method": "email"
}
```

### create_invoice

Save a customer invoice with dates and rows. It is saved, not booked and not sent. Access: write, asks the user first. REST: `POST /api/v1/fortnox/customers/{customer_number}/invoices`. MCP: `fortnox_write → create_invoice`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `customer_number` | string | yes | Customer number from list_customers. |
| `invoice_date` | date | no | Invoice date. Default: today. |
| `due_date` | date | no | Due date. Default: from the customer payment terms. |
| `rows` | array | yes | Objects with article_number or description, quantity, unit_price and optional discount_percent. |
| `comments` | string | no | Text shown on the invoice. |

Creates a customer invoice for an existing customer from the rows you give and returns its number and totals. The invoice is saved, so it can still be changed in Fortnox; it is not booked and not sent until bookkeep_invoice and send_invoice run. Each row needs a description or an article_number, a quantity and a unit price. Invoice and due date default to the customer terms in Fortnox. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "invoice_number": "2381",
  "customer_number": "1042",
  "customer": "Nordlys Design AB",
  "state": "saved",
  "sent": false,
  "invoice_date": "2026-10-14",
  "due_date": "2026-11-13",
  "net": 12000,
  "vat": 3000,
  "total": 15000,
  "currency": "SEK"
}
```

### bookkeep_invoice

Book a saved invoice. A booked invoice can no longer be changed. Access: write, asks the user first. REST: `POST /api/v1/fortnox/invoices/{invoice_number}/bookkeep`. MCP: `fortnox_write → bookkeep_invoice`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `invoice_number` | string | yes | Invoice number from list_invoices or create_invoice. |

Books a saved customer invoice, as the Bokför button does, and returns its voucher number. After booking Fortnox does not allow changes to the invoice, so check the totals first with get_invoice. Fails if the invoice is already booked or the financial year does not exist. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "invoice_number": "2381",
  "state": "booked",
  "voucher": "A 143",
  "total": 15000,
  "currency": "SEK"
}
```

### send_invoice

Send a booked invoice to the customer by email, e-invoice or print service. Access: write, asks the user first. REST: `POST /api/v1/fortnox/invoices/{invoice_number}`. MCP: `fortnox_write → send_invoice`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `invoice_number` | string | yes | Invoice number from list_invoices or create_invoice. |
| `method` | enum | no | email, e_invoice or print_service. Default: the delivery method set on the customer. |

Sends a booked invoice to the customer, as the Skicka button does, and marks it as sent. Methods are email, e_invoice and print_service; e-invoice only works when it has been activated in the Fortnox invoicing settings. Failed deliveries, for example an invalid email address, show up in Fortnox under the Misslyckade filter and in the next list_invoices call. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "invoice_number": "2381",
  "method": "email",
  "to": "ekonomi@nordlys.example",
  "sent": true
}
```

### register_payment

Register a received payment, full or partial, against a customer invoice. Access: write, asks the user first. REST: `POST /api/v1/fortnox/invoices/{invoice_number}/payments`. MCP: `fortnox_write → register_payment`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `invoice_number` | string | yes | Invoice number from list_invoices or create_invoice. |
| `amount` | number | yes | Amount received, in the invoice currency. |
| `payment_date` | date | no | Date the money arrived. Default: today. |

Registers a payment on one customer invoice with the amount and the payment date you give, like Registrera inbetalning in Fortnox. A partial payment leaves the invoice open for the rest; a payment that covers the balance marks it as fully paid. Read the balance with get_invoice first. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "invoice_number": "2377",
  "paid_amount": 15000,
  "payment_date": "2026-10-13",
  "balance": 0,
  "status": "fully paid",
  "currency": "SEK"
}
```

### create_voucher

Book a voucher with rows of account, debit and credit in a voucher series. Access: write, asks the user first. REST: `POST /api/v1/fortnox/vouchers`. MCP: `fortnox_write → create_voucher`.

| Parameter | Type | Required | Description |
|---|---|---|---|
| `voucher_series` | string | yes | Voucher series code, e.g. A. |
| `transaction_date` | date | yes | Booking date, inside an existing financial year. |
| `description` | string | yes | Voucher description. |
| `rows` | array | yes | Objects with account and either debit or credit. |

Books one voucher with a transaction date, a description, a voucher series and rows. Each row has an account and either a debit or a credit amount; debits must equal credits. The date must fall inside an existing financial year and every account must exist and be active, or Fortnox rejects the voucher. Returns the series and voucher number. By default you confirm each call; you can switch that off for this tool.

Example response:

```json
{
  "voucher_series": "A",
  "voucher_number": 142,
  "transaction_date": "2026-10-31",
  "description": "Accrued rent, October",
  "rows": [
    {
      "account": "5010",
      "debit": 8000,
      "credit": 0
    },
    {
      "account": "2990",
      "debit": 0,
      "credit": 8000
    }
  ]
}
```

## How do I connect Fortnox to Claude Code, Codex or Cursor?

Connecting Fortnox takes three steps: sign up, sign in to Fortnox once in your Cloud Browser and enable it for agents, then add one MCP server or call the REST API with the same key.

### Connect Fortnox to your agent.

1. **Create an account** Sign up and add Fortnox in the console. Your API key is there too.

2. **Sign in to Fortnox in your Cloud Browser** Open your Cloud Browser in the console: your own Chrome in the cloud. Sign in to Fortnox there yourself, the way you always do, then press Enable for agents, read only or read and write. We never save your password, and your agent keeps working even when your computer is off.

3. **Add Cotlet to your agent** Paste the snippet for your client. The same server and key serve every app you connect, so you do this once.

   Claude Code:

```
claude mcp add --transport http cotlet \
  https://cotlet.dev/mcp/v1 \
  --header "Authorization: Bearer $COTLET_API_KEY"
```

   Cursor:

```
{
  "mcpServers": {
    "cotlet": {
      "url": "https://cotlet.dev/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${COTLET_API_KEY}"
      }
    }
  }
}
```

   Codex:

```
# ~/.codex/config.toml
[mcp_servers.cotlet]
url = "https://cotlet.dev/mcp/v1"
bearer_token_env_var = "COTLET_API_KEY"
```

4. **Ask your agent** Ask in plain words. Your agent finds the Fortnox tools on the server and calls them for you; anything that reaches other people waits for your OK unless you switch that off for a tool.

```
Here is this month's billing list. For each customer, create the invoice in Fortnox with the hours and rate I gave, book it, and send it by email. Create customers that do not exist yet.
```

### Call Fortnox from your scripts.

1. **Export your API key** Your scripts use the same API key as your agent. Keep it in an environment variable, never in your code.

```
export COTLET_API_KEY="cotlet_..."
```

2. **Call a tool** Every tool is an endpoint under /api/v1/fortnox with its own method and path, listed with the endpoints above. Path parameters go in the URL; the other parameters go in the query for GET and DELETE and in a JSON body otherwise.

```
curl -X POST https://cotlet.dev/api/v1/fortnox/customers/1042/invoices \
  -H "Authorization: Bearer $COTLET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"invoice_date":"2026-10-14","due_date":"2026-11-13","rows":[{"description":"Consulting, October","quantity":10,"unit_price":1200}]}'
```

3. **Read the result** You get plain JSON back, ready for your script. A failed call costs nothing.

```
{
  "invoice_number": "2381",
  "customer_number": "1042",
  "customer": "Nordlys Design AB",
  "state": "saved",
  "sent": false,
  "invoice_date": "2026-10-14",
  "due_date": "2026-11-13",
  "net": 12000,
  "vat": 3000,
  "total": 15000,
  "currency": "SEK"
}
```

## Why use Cotlet for Fortnox?

**Built for agents**

- One MCP server for every app you connect.
- The same tools as a REST API for scripts and cron jobs.
- Works with Claude Code, Codex and Cursor.

**Your login stays yours**

- You sign in to Fortnox yourself, in your own Cloud Browser. We never save your password; the profile is encrypted with AES-256-GCM, the cipher 1Password uses.
- A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory.
- The model never sees a login.
- No stored passwords, no CAPTCHA solving, no MFA bypass.

**You stay in control**

- Scope each API key: its apps, its tools, read only or read and write.
- Anything that reaches other people waits for your OK, so a leaked key cannot post or message as you.
- Every background request listed in your Background activity. Disable for agents in one click.

**Kept working for you**

- We test every integration every 6 hours.
- When Fortnox changes, the tool pauses until we fix it.
- Failed calls cost nothing.

## Is it safe to connect Fortnox to Cotlet?

Yes. You sign in to Fortnox yourself, in your own Cloud Browser, and we never save your password. Your agents only get Fortnox once you enable it, and every background request is listed. The browser profile is stored encrypted with AES-256-GCM, the same cipher 1Password uses for its vaults and Apple for iCloud Keychain. Independent public scanners grade cotlet.dev A+ and find it clean; click a result to rerun it yourself.

- **A+ on Qualys SSL Labs**: Encryption in transit: TLS setup and certificates, on all four server addresses. [Live result](https://www.ssllabs.com/ssltest/analyze.html?d=cotlet.dev)
- **A+ on securityheaders.com**: Browser protections sent with every page, all six headers present. [Live result](https://securityheaders.com/?q=cotlet.dev&followRedirects=on)
- **A+ on Mozilla Observatory**: Mozilla's web security baseline: score 120 of 100, 12 of 12 tests passed. [Live result](https://developer.mozilla.org/en-US/observatory/analyze?host=cotlet.dev)
- **Clean on Sucuri SiteCheck**: No malware, spam or defacement, and not on any of 9 blocklists, Google Safe Browsing included. [Live result](https://sitecheck.sucuri.net/results/cotlet.dev)

[How Cotlet protects your access](https://cotlet.dev/security.md)

### Common concerns

**Who runs Cotlet?**

Cotlet is run by Take Group, a Polish software company working since 2019. Take Group runs about 3,200 websites on its own systems and has its own DevOps team for infrastructure security. We built and used integrations like this inside the company for years before opening them as Cotlet.

**Is this an official Fortnox integration?**

No, Cotlet is independent of Fortnox. Fortnox's own API is open only to approved partners. Cotlet works through your own Fortnox account, the way you use Fortnox in the browser, so you need no partner approval and no developer setup.

**What about client data and GDPR?**

Cotlet is run from the EU and follows the GDPR. Cloud Browsers run in Finland, a Tier 1 country in the ITU Global Cybersecurity Index 2024. Data passes through a call and is not kept after it.

**Can I start with read only?**

Yes. Enable the app for agents as read only, or make the API key read only, and anything that reaches other people waits for your OK unless you switch that off per tool.

**Is it reliable?**

Every Cotlet service is checked every 3 minutes from Europe, North America, Asia and Australia. The live results and any outage are public at status.cotlet.dev.

**How do I stop?**

Press Disable for agents next to Fortnox in your console: your agents lose access at once and you stay signed in. Signing out of Fortnox in the browser works too, and Reset browser deletes the whole profile.

## Is there a Fortnox MCP server on GitHub?

Yes. Community Fortnox MCP servers exist on GitHub, usually maintained by one person. You install one on your own computer, give it OAuth credentials from a Fortnox integration you registered, and keep it running yourself; when Fortnox changes its API or scopes, it stops working until you or the maintainer fix it. The official API is the other route: you register an integration and build the calls yourself. Cotlet hosts the same kind of server for you, signs in to your Fortnox account in a browser, and our team keeps it working.

|  | GitHub MCP server | Cotlet |
|---|---|---|
| Setup | Register a Fortnox integration, request scopes, install the server, add its credentials to each MCP client | Sign up, sign in to Fortnox once, add one MCP server or API key |
| When Fortnox changes | It breaks until you or the maintainer fix it | Our team tests it daily and fixes it for you; failed calls are free |
| Your Fortnox access | Client ID, client secret and a refresh token in a file on your computer | Signed in inside your own Cloud Browser in the EU, profile encrypted, only for the apps you enable, disabled for agents in one click |
| When access expires | Tools fail until you authorize again by hand | Your Cloud Browser keeps you signed in; if Fortnox logs you out, your agent gets a link to sign in again |
| Upkeep | You update, monitor and debug it yourself | Nothing to host or update |
| Where it runs | Your computer, while it is on | Hosted: Claude Code, Codex, Cursor, n8n and scripts, also on a schedule |
| Price | Free, paid for with your time | Free 7-day trial, then pay-as-you-go credit packs, no subscription |

### Which one fits you

**Pick Cotlet if**

- you are not a developer, or you do not want to maintain a server
- you need it to keep working when Fortnox changes, without checking it yourself
- your agent or a script should run it on a schedule, also while your computer is off

**Pick an open-source server if**

- you are comfortable installing, updating and fixing it yourself
- you want your sign-in to stay on your own computer
- you only need it now and then, from one MCP client

## How much does the Fortnox API cost?

Free 7-day trial with 2,000 credits, no card needed. After that, the Fortnox API is pay as you go with no limit on apps: Credit packs from $29 for 5,000 credits, one-time, no subscription. A successful call uses 10 credits (about $0.04 to $0.06), your Cloud Browser uses 50 credits a day while it has an app enabled for agents, however many apps that is, and an agent driving the browser itself uses 5 credits a minute. Credit packs stay valid for 12 months and stack, so unused credits carry over.

| Credits | Price, one time | Calls at 10 credits | Per 1,000 credits |
|---|---|---|---|
| 5,000 | $29 | 500 | $5.80 |
| 15,000 | $79 | 1,500 | $5.27 |
| 32,000 | $149 | 3,200 | $4.66 |
| 60,000 | $249 | 6,000 | $4.15 |

Only successful calls use credits; failed calls and timeouts cost nothing. At a balance of 0 calls pause, never a surprise charge. Authenticate with the `Authorization: Bearer` header. [See full pricing](https://cotlet.dev/pricing.md)

## How Cotlet holds your access

Cotlet hosts MCP servers and REST APIs for apps with no usable API. Your agent works in your own Fortnox account.

- **Company details:** Cotlet is run by Take Group sp. z o.o., a company registered in Poland. Its full address and registration numbers are in the Terms of service. [Terms of service](https://cotlet.dev/terms)
- **Your sign-in:** You sign in to Fortnox yourself, in your own Cloud Browser: a Chrome we run for you in the EU, one per app. We never save your password (password saving is off), the profile is stored encrypted with AES-256-GCM, and your agents get Fortnox only after you enable it. When Fortnox signs you out, your agent gives you a link to sign in again. [Security](https://cotlet.dev/security.md)
- **Revoking access:** Press Disable for agents next to Fortnox, sign out of Fortnox in your Cloud Browser, or reset the browser. Every background request is listed in your Background activity. Actions that reach other people wait for your OK unless you switch that off per tool.
- **What we never do:** Store passwords, solve CAPTCHAs or bypass MFA.
- **Fortnox's terms:** You use your own Fortnox account and stay responsible for following Fortnox's terms. Cotlet is independent and not affiliated with Fortnox. [Terms](https://cotlet.dev/terms)
- **Contact:** Questions about the company, security or an app: [contact@cotlet.dev](mailto:contact@cotlet.dev)

## Frequently asked questions

**How do I get access?**

Sign up free, open Fortnox in the console and press Request access. Then you create your API key and connect Fortnox there.

**Do I need to be technical?**

No. You sign in to Fortnox once in your Cloud Browser, a normal Chrome you open from the console, and paste one command into your agent, or one URL into n8n. Your agent can walk you through it. There is no server to install, update or fix.

**Is it safe to connect Fortnox to Cotlet?**

Yes. You sign in to Fortnox yourself, in your own Cloud Browser in the EU, and we never save your password. Your agents only get Fortnox once you enable it, every background request is listed, and the browser profile is stored encrypted with AES-256-GCM, the cipher 1Password uses for its vaults. The AI model never sees a login, posts and messages wait for your OK, and Disable for agents cuts access in one click. Independent scanners grade cotlet.dev A+ on Qualys SSL Labs, securityheaders.com and Mozilla Observatory; live results are on https://cotlet.dev/security.

**Is a hosted server safer than a local one? My Fortnox sign-in would leave my computer.**

On Cotlet you sign in inside your own Cloud Browser, which only you open, and its profile is stored encrypted with AES-256-GCM in the EU. Agents get only the apps you enable, and every background request is listed. A local server keeps your Fortnox cookie in a plain file on your computer, readable by any program you run, and stops when your computer is off.

**Why does Cotlet send requests instead of clicking in my browser?**

To be fast, Cotlet doesn't click through Fortnox's pages. It sends the same requests your browser would, from your browser's IP with its cookies, without opening a window. Fortnox sees the same browser and IP you signed in with, and every request is listed in your Background activity.

**What if someone gets my Cotlet API key?**

The key holds no Fortnox login or cookies, it only asks Cotlet to run a tool. It can call only the apps and tools you gave it, and a read-only key changes nothing. Anything that reaches other people, like posts, comments or messages, waits for your OK in the dashboard by default, so a leaked key cannot post or message as you. When you switch approval off for a scheduled job, give that job its own key limited to that one tool. Every call is in your activity log, and deleting the key ends access at once.

**Why a signed-in browser and not OAuth, like other integration platforms?**

Fortnox offers no OAuth token you can simply grant for these tools: its official API leaves them out or needs a developer app, a plan or an approval first (see the official API section above). That is why Cotlet sets the limits itself: per key, per tool, with your approval before anything reaches other people. Cotlet is run by Take Group sp. z o.o., an EU company (VAT PL6342984273).

**Which Fortnox licence does my company need?**

Cotlet works in your own Fortnox account, so you need the access your user already has: Fakturering for invoices and payments, Bokföring for vouchers. For comparison, the official API ties each scope to a licence, for example invoice to Order or Kundfaktura and bookkeeping to Bokföring or Kundfaktura.

**Do I have to register a Fortnox developer integration?**

No. Cotlet signs in to your Fortnox account like you do, so you do not register an integration, choose scopes or hand out a client secret. Fortnox's own API route needs a registered integration with scopes, and every scope there grants read and write.

**Can my agent post or send messages in Fortnox without asking me?**

No. Every call to create_invoice, bookkeep_invoice, send_invoice, register_payment or create_voucher waits for your OK by default. For scheduled automations you can switch confirmation off per tool in your dashboard, for example only for approvals. create_customer runs without asking, because it sends nothing to anyone and one call undoes it.

**Can I use the Fortnox API in n8n?**

Yes. Add https://cotlet.dev/mcp/v1 with your API key in n8n's MCP Client node, or call its endpoints under https://cotlet.dev/api/v1/fortnox from the HTTP Request node.

---

Give your AI agents your signed-in browser.

**Product:** [Integrations](https://cotlet.dev/integrations.md) · [Use cases](https://cotlet.dev/use-cases.md) · [How it works](https://cotlet.dev/how-it-works.md) · [Pricing](https://cotlet.dev/pricing.md) · [Security](https://cotlet.dev/security.md)

**Resources:** [Blog](https://cotlet.dev/blog.md) · [API docs](https://cotlet.dev/docs.md) · [Help center](https://cotlet.dev/help.md) · [Changelog](https://cotlet.dev/changelog.md) · [GitHub](https://github.com/cotletdev/cotlet)

**Solutions:** [For developers](https://cotlet.dev/for-developers.md) · [For automation agencies](https://cotlet.dev/for-agencies.md)

**Company:** [About](https://cotlet.dev/about.md) · [AI info: company facts](https://cotlet.dev/ai-info.md) · [Contact](https://cotlet.dev/contact.md)

**Legal:** [Terms of service](https://cotlet.dev/terms) · [Privacy policy](https://cotlet.dev/privacy) · [Refund policy](https://cotlet.dev/refunds) · [Acceptable use](https://cotlet.dev/acceptable-use) · [Cookie policy](https://cotlet.dev/cookies) · [DPA](https://cotlet.dev/dpa) · [Subprocessors](https://cotlet.dev/subprocessors)

**Elsewhere:** [Status page](https://status.cotlet.dev) · [Cotlet on GitHub](https://github.com/cotletdev) · [Cotlet on X](https://x.com/cotletdev) · [Cotlet on LinkedIn](https://www.linkedin.com/company/cotletdev) · [Cotlet on Product Hunt](https://www.producthunt.com/products/cotlet) · [Cotlet on Crunchbase](https://www.crunchbase.com/organization/cotlet) · [Cotlet on SaaSHub](https://www.saashub.com/cotlet)

Cotlet is an independent service. It is not affiliated with, endorsed by or sponsored by any of the products listed on this site. Product names are trademarks of their respective owners.

## For AI agents: sign your user up

Is your user asking you to sign them up for Cotlet? You can do it for them, no account or key needed.

1. Read the fields and their allowed values: GET https://cotlet.dev/api/v1/access-requests
2. Ask the user for each value: email, apps, what you will do with them. If they leave the password to you, generate a strong one and show it to them.
3. Show the user what you will send, then POST it as JSON to https://cotlet.dev/api/v1/access-requests.

One call creates the account and sends the access request; we email the user when access is granted.