Point your AI at your books. They stay yours.

Every install ships a self-documenting 793-operation local REST API at /openapi.json. Nothing to apply for, no OAuth review: the API is on your computer, behind your password.

  • Claude Code
  • Grok
  • Codex CLI
  • Gemini CLI
  • anything that speaks HTTP
Set it up in three steps Agent instructions template

How it stays safe

An agent only ever works through a key, and every step has a guard.

Set it up in three steps

The first one is yours. Your agent does the rest.

  1. Install and set your password

    Open SlowBooks once and set the operator password. A person should always do this part.

  2. Make a key for the agent

    Settings → API Tokens. Pick a role (bookkeeper for day-to-day work, read-only to just look) and copy the key.

  3. Paste this into your agent

    It discovers the API itself, migrates with a dry run first, and checks the trial balance.

Paste into your agent
You're helping me set up SlowBooks Pro, a local accounting app at
http://127.0.0.1:3001. The API is self-documenting: GET /openapi.json.
Auth: I'll give you an API token (made in Settings -> API Tokens);
send it as "Authorization: Bearer sbp_..." on every request. The token
is scoped and audit-attributed. First-run setup is already done.

1. Discover the API from /openapi.json before calling anything
   (send the token there too; GET /api/auth/status is the only
   unauthenticated probe).
2. I'm migrating from [MYOB / Xero / Sage 50 / Wave / Zoho Books /
   GnuCash]. Tell me exactly what to export from it, then use
   POST /api/migration/{source}/dry-run and only call /import after
   the dry-run returns ok=true with zero errors.
3. Verify the books: GET /api/reports/trial-balance with start_date
   and end_date covering the imported data's dates. Total debits
   must equal total credits. Show me both numbers.
4. Configure the basics via PUT /api/settings - company address,
   invoice prefix, default terms. Ask me for real values.
5. Finish with a one-paragraph summary of my profit & loss for the
   imported period (GET /api/reports/profit-loss).

Never delete anything. If an endpoint errors, show me the response
verbatim instead of improvising.

A real run

That prompt against a fresh install, migrating MYOB’s “Clearwater” sample company. Unedited numbers.

agent session
[ 0.2s] discover   GET  /openapi.json ............ v2.31.9 · 793 operations
[ 1.5s] login      POST /api/auth/login .......... 200
[ 1.6s] dry-run    POST /api/migration/myob/dry-run
                   ok=true · 101 accounts · 328 journals
                   note: TB differs on 3 accounts netting to zero,
                   one balanced opening journal will be posted
[ 1.6s] import     POST /api/migration/myob/import
                   101 accounts · 328 journals written
[ 3.6s] verify     GET  /api/reports/trial-balance
                   51 rows · debits 877,105.88 = credits 877,105.88 ✓
[ 3.6s] report     GET  /api/reports/profit-loss . 200
        settings   PUT  /api/settings ............ 200

3.6 seconds end-to-end. Books migrated, balanced, verified.

Things to ask for

Once it’s set up, talk to it like a bookkeeper.

Monthly close

“Walk my monthly close: unreconciled bank lines, unsent invoices, unpaid bills due in 14 days, then a P&L vs last month.”

  • Unreconciled bank lines
  • Unsent invoices
  • Unpaid bills due in 14 days
  • P&L against last month

Ready to close✓

Collections

“List invoices 30+ days overdue and draft a polite chasing email for each customer, using the templates in /api/email-templates.”

  • Invoices 30+ days overdue
  • A polite chasing email for each customer
  • Written from your own email templates

Drafts for you to send✓

Bank feed triage

“Fetch unmatched bank transactions and propose a category for each, citing the bank rule or past transaction you based it on. Don’t apply anything until I approve.”

  • Unmatched bank lines
  • A proposed category for each
  • The bank rule or past entry behind it

Applied without you0

Explain the numbers

“Why did my margin drop in July? Compare P&L line items against June and show the three biggest movers.”

  • July’s P&L against June
  • Every line item compared
  • The biggest movers pulled out

Biggest movers3

Honest limits

We’d rather you know.

A local API is not local inference

The company file and the API never leave your machine. A cloud-backed agent (Claude Code, Codex CLI, Gemini CLI, Grok) does its thinking on its provider’s servers, so whatever it reads from your books goes there under that provider’s terms. If no accounting data may leave the machine, run a model locally, point the agent at it, and check it makes no outbound calls. The built-in AI Insights works the same way: it sends the figures it’s given to the provider you chose, over public HTTPS only.

Keys are scoped, and never administrators

Settings → API Tokens makes read-only, bookkeeper or accountant keys (Authorization: Bearer sbp_...). Since v2.29.0 a key is never an administrator, and no key can manage users or other keys. Every change a key makes is in the audit log as token:<label>, and you can revoke it any time. Your password stays out of the agent’s context.

Keep it local

This is for agent sessions on the machine, or the office network, where SlowBooks runs. Don’t expose the API to the internet to make a cloud agent work; that gives away the whole point.

An MCP server is not here yet

A server with curated, scope-limited tools is the natural next step and is under consideration. Today agents use the REST API directly.

For the agents reading this

Start every session oriented.

/llms.txt

The site’s map for language models: the API index, what each area does, the house rules.

Agent instructions template

Drop it in your data folder as CLAUDE.md for Claude Code or GROK.md for Grok (or AGENTS.md, GEMINI.md). It teaches the auth flow, dry-run first, and the conventions.

Try it

Signed installers, nothing to sign up for. Install, set a password, open your agent.

Download for Windows Download for macOS All platforms