Qonto is automatable through its Business API

Qonto is automatable today through the Business API. The developer introduction says Qonto provides two REST API collections and that responses are JSON. API calls must use HTTPS and, except for the browser authorization URL, must come from a backend. Authentication is an API key or OAuth 2.0. The API key is the organization sign-in and secret key joined by a colon in the Authorization header, without Base64. OAuth is an authorization-code flow at https://oauth.qonto.com/oauth2/auth. The access token lasts 1 hour and is sent as Authorization Bearer. A refresh token lasts 90 days, requires the offline_access scope, and rotates on use. The authentication table lists transactions, statements, invoices, clients, cards, payment links, webhook subscriptions, SEPA beneficiaries, and international transfers, and it marks which of those accept an API key. Card creation and international transfers require OAuth, and several of those writes also require Strong Customer Authentication. The introduction says the API key is the simpler method when the endpoint allows it. The official MCP server at https://mcp.qonto.com/mcp uses OAuth on the same identity provider. One authorization is one organization. The multi-organization URL is https://mcp.qonto.com/multi-organization/mcp. The overview says the server can read transactions, statements, invoices, quotes, clients, cards, requests, and labels, and that it can draft invoices and manage cards. It says SEPA transfers from a beneficiary, international transfers, webhooks, terminals, and onboarding are not in the server. Owners, admins, and accountants can connect. Managers and employees need an owner or admin to enable MCP. The official qonto CLI signs in with browser OAuth, stores the session in the operating system credential store, and prints JSON when the output is piped or when --output json is set. The CLI overview says it cannot make SEPA, internal, or international transfers. Zapier, Make, Power Automate, and n8n were not opened. Computer-use viability is unassessed. The API scores 7. The MCP server scores 7. The CLI scores 6. The API is the best path because it documents transfer creation, which the MCP server and the CLI both leave out. An API key also covers many reads without a registered OAuth application.

Best path today: api · Overall automatability: 7/10