How to Integrate Bolt.new with Expensify

Expensify Integration Server credentials are different from your standard Expensify login. They are separate API keys specifically for programmatic access and are found in a dedicated section of Expensify's settings. Log in to your Expensify account at expensify.com and navigate to Settings (gear icon in top navigation) → Integrations → API. If you do not see an Integrations section in Settings, your account tier may not include API access — Integration Server access is available on Professional ($9/user/month) and Control ($18/user/month) plans. On the API settings page, you will find your partnerUserID (an email-format identifier unique to your integration) and a partnerUserSecret (a long alphanumeric string that acts as your API password). These credentials authenticate all requests to the Integration Server — every API call includes them in the request body. The partnerUserSecret is sensitive and should be treated like a password. Copy both values immediately because the partnerUserSecret may be shown only once. Additionally, make note of your Expensify policy ID if you plan to create expenses — the policy ID is visible in the URL when you navigate to Settings → Policies → your policy name. You will need the policy ID to create expenses and reports under the correct company policy rather than under a personal account.

Add your Expensify credentials to the .env file in your Bolt project. Unlike many APIs that use an Authorization Bearer header, Expensify's Integration Server requires credentials embedded in the request body JSON — never in headers. This is intentional: all Expensify API calls go through a single POST endpoint (https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations) with the credentials included in a credentials object inside the request body. Create a helper function that wraps the Expensify API call pattern: it accepts a command string and any additional parameters, constructs the full request body including credentials, POSTs to the Integration Server, and returns the parsed response. This helper becomes the foundation for all your Expensify API routes. The request body must be sent as application/x-www-form-urlencoded with a requestJobDescription parameter containing the JSON — this is unusual and differs from most modern APIs that accept application/json. The requestJobDescription parameter value is a JSON string (not an object) containing type, credentials, and command fields. Bolt generates this wrapper correctly when you describe the Expensify Integration Server's specific request format in your prompt.

1// lib/expensify.ts
2const EXPENSIFY_API_URL = 'https://integrations.expensify.com/Integration-Server/ExpensifyIntegrations';
3
4interface ExpensifyCommand {
5  type: string;
6  [key: string]: unknown;
7}
8
9export async function callExpensify(command: ExpensifyCommand) {
10  const credentials = {
11    partnerUserID: process.env.EXPENSIFY_PARTNER_USER_ID!,
12    partnerUserSecret: process.env.EXPENSIFY_PARTNER_USER_SECRET!,
13  };
14
15  const requestJobDescription = JSON.stringify({
16    type: command.type,
17    credentials,
18    ...command,
19  });
20
21  const body = new URLSearchParams();
22  body.append('requestJobDescription', requestJobDescription);
23
24  const response = await fetch(EXPENSIFY_API_URL, {
25    method: 'POST',
26    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
27    body: body.toString(),
28  });
29
30  if (!response.ok) {
31    throw new Error(`Expensify API error: ${response.status} ${response.statusText}`);
32  }
33
34  return response.json();
35}

Fetching expense reports from Expensify uses the GetReportIDList command to get report IDs and the GetReport command to retrieve full report details. The GetReportIDList command accepts filter parameters: startDate, endDate, statusFilters (a comma-separated list of report statuses such as 'APPROVED', 'REIMBURSED', 'OPEN', 'SUBMITTED'), and optionally an employeeEmail to filter by submitter. This command returns a list of report IDs matching the filter criteria. You then need to call GetReport for each ID to retrieve the full report details including the transaction list, total amount, submitter information, and current status. For a dashboard showing the last 30 days of reports, prompt Bolt to create a route that calls GetReportIDList with appropriate date filters and then fetches a reasonable number of report details. Avoid fetching more than 20-30 reports in a single request to prevent timeout issues. The route should return a structured array of report summaries that the dashboard component can render directly. Note that Expensify API responses sometimes include both a responseCode field (200 for success, 410 for error) and the actual data — always check responseCode before processing the response data to handle API-level errors that come back with HTTP 200 status codes.

1// app/api/expensify/reports/route.ts
2import { NextResponse } from 'next/server';
3import { callExpensify } from '@/lib/expensify';
4
5export async function GET() {
6  try {
7    const endDate = new Date().toISOString().split('T')[0];
8    const startDate = new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString().split('T')[0];
9
10    const listResponse = await callExpensify({
11      type: 'get',
12      command: 'GetReportIDList',
13      inputSettings: {
14        startDate,
15        endDate,
16        statusFilters: 'APPROVED,REIMBURSED,OPEN,SUBMITTED',
17      },
18    });
19
20    if (listResponse.responseCode !== 200) {
21      return NextResponse.json({ error: listResponse.responseMessage }, { status: 400 });
22    }
23
24    const reportIDs: string[] = (listResponse.reportIDs || []).slice(0, 20);
25
26    const reports = await Promise.all(
27      reportIDs.map(async (reportID) => {
28        const detail = await callExpensify({
29          type: 'get',
30          command: 'GetReport',
31          reportID,
32        });
33        return {
34          reportID,
35          reportName: detail.reportName || `Report ${reportID}`,
36          total: (detail.total || 0) / 100,
37          status: detail.status,
38          submitter: detail.submitter,
39          submittedDate: detail.submittedDate,
40        };
41      })
42    );
43
44    return NextResponse.json({ reports });
45  } catch (error) {
46    const message = error instanceof Error ? error.message : 'Unknown error';
47    return NextResponse.json({ error: message }, { status: 500 });
48  }
49}

Creating expenses programmatically uses the CreateTransaction command, which accepts the core fields of an expense: amount, currency, merchant, created (date in YYYY-MM-DD format), comment, category, and the policyID that the expense belongs to. The amount field should be passed in cents (integer) — multiply the dollar amount by 100. The employee email field (employeeEmail) associates the expense with a specific user in your Expensify policy. If no employeeEmail is specified, the expense is created under the credentials account holder. After creating a transaction, you may want to automatically create an expense report and add the transaction to it using the CreateReport command, then submit the report using the UpdateReport command with action: 'submit'. This three-step process — create transaction, create report, submit report — mirrors the workflow an employee follows manually in Expensify and is the standard programmatic submission flow. Bolt generates these three API calls when you describe the workflow clearly in your prompt. Because these are outbound HTTP calls to Expensify's server, they work during development in Bolt's WebContainer preview — you will see real data appear in your Expensify account after running them.

1// app/api/expensify/create-expense/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import { callExpensify } from '@/lib/expensify';
4
5export async function POST(request: NextRequest) {
6  const { amount, merchant, date, category, comment, employeeEmail } = await request.json();
7
8  try {
9    // Step 1: Create the transaction
10    const transaction = await callExpensify({
11      type: 'create',
12      command: 'CreateTransaction',
13      transactionList: [{
14        created: date,
15        currency: 'USD',
16        merchant,
17        amount: Math.round(amount * 100),
18        category,
19        comment,
20        ...(employeeEmail ? { employeeEmail } : {}),
21      }],
22      policyID: process.env.EXPENSIFY_POLICY_ID,
23    });
24
25    if (transaction.responseCode !== 200) {
26      return NextResponse.json({ error: transaction.responseMessage }, { status: 400 });
27    }
28
29    // Step 2: Create an expense report
30    const report = await callExpensify({
31      type: 'create',
32      command: 'CreateReport',
33      policyID: process.env.EXPENSIFY_POLICY_ID,
34      reportName: `${merchant} - ${date}`,
35      transactionIDList: transaction.transactionIDList,
36    });
37
38    return NextResponse.json({ reportID: report.reportID });
39  } catch (error) {
40    const message = error instanceof Error ? error.message : 'Unknown error';
41    return NextResponse.json({ error: message }, { status: 500 });
42  }
43}

With the API routes in place, prompt Bolt to build the dashboard interface that connects to them. The dashboard should show a summary section at the top with three metric cards: total pending amount (reports with SUBMITTED or OPEN status), total approved and awaiting reimbursement, and total reimbursed this month. Below the metrics, show a table of recent expense reports with columns for report name, submitter, date, total amount, and status. Add a status badge with color coding (yellow for pending, green for approved, blue for reimbursed). Include an inline 'New Expense' button that opens a modal form with fields for merchant, amount, date, and category. Submitting the form calls your /api/expensify/create-expense route and refreshes the report list. The entire dashboard works in Bolt's WebContainer during development since it only makes outbound API calls to Expensify. For deployment, push to GitHub and connect to Netlify or Vercel. Set EXPENSIFY_PARTNER_USER_ID, EXPENSIFY_PARTNER_USER_SECRET, and EXPENSIFY_POLICY_ID as environment variables in your hosting dashboard. Expensify does not send webhook callbacks in the traditional sense for this API, so there are no incoming connections to configure — the WebContainer limitation for incoming webhooks does not apply here.