--- title: "Upload the month to OneDrive" description: "Register a Microsoft Entra app, store its secrets, connect your Microsoft account and choose a folder, then upload a month straight into OneDrive." --- > Documentation Index > Fetch the complete documentation index at: https://receipts.nuits.net/docs/llms.txt > Use this file to discover all available pages before exploring further. # Upload the month to OneDrive Use this guide to send each month's files straight into a OneDrive or SharePoint folder, such as one your accountant shared with you, instead of downloading and unzipping the ZIP. The upload uses your own Microsoft sign-in through Microsoft Graph. Nothing is sent to Microsoft until you connect, and the feature stays off unless all three values below are set. ## Prerequisites - A deployed copy of Nuits Receipts on a hostname you will keep. The sign-in redirect address includes the hostname, so changing it later means updating the Entra app. - A Microsoft account with OneDrive, and edit rights on the destination folder. - A Microsoft Entra tenant to register the app in. A work or school account already has one. What Microsoft requires to register an app, and whether a personal account can do it, can change, so follow [Microsoft's current guide to registering an app](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) rather than relying on these pages for that part. - Wrangler signed in to the account that runs the Worker, and the config file you deploy with (`wrangler.production.jsonc` if you used `bun run setup`). - `openssl`, to create the encryption key. ## Register the app in Microsoft Entra 1. **Find your redirect URI** The redirect URI is `https:///settings/onedrive/callback`, for example `https://receipts.example.com/settings/onedrive/callback`, or `https://receipts.example.com/app/settings/onedrive/callback` with `APP_BASE_PATH=/app`. Once `MS_CLIENT_ID` and both secrets are set, **Settings > Sending > OneDrive** shows the exact value for your deployment under **Redirect URI for Microsoft Entra**. 2. **Create the registration** Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > App registrations** and select **New registration**. - **Name**: anything, for example "Receipts upload". - **Supported account types**: **Any Entra ID Tenant + Personal Microsoft accounts**. The app signs in through Microsoft's `common` endpoint, so it needs this option. - **Redirect URI**: platform **Web**, with the value from the previous step. Select **Register**. 3. **Copy the client ID** On the app's **Overview** page, copy the **Application (client) ID**. It is a GUID. 4. **Create a client secret** Go to **Certificates & secrets > Client secrets > New client secret**. Copy the **Value** (not the Secret ID) straight away; it is shown only once. Note the expiry date. 5. **Add the API permissions** Go to **API permissions > Add a permission > Microsoft Graph > Delegated permissions** and add `Files.ReadWrite.All`, `offline_access` and `User.Read`. `Files.ReadWrite.All` is needed to write into a folder in someone else's OneDrive. Personal accounts consent at sign-in; a work or school tenant may need an administrator to grant consent. ## Give the values to the Worker 1. **Store the client secret** ```sh bunx wrangler secret put MS_CLIENT_SECRET --config wrangler.production.jsonc ``` Paste the secret **Value** when asked. 2. **Create and store the encryption key** ```sh openssl rand -base64 32 | bunx wrangler secret put ONEDRIVE_TOKEN_KEY --config wrangler.production.jsonc ``` This key encrypts the stored Microsoft sign-in. If you change it later, the stored sign-in can no longer be read and you connect again. 3. **Set the client ID and deploy** Add the client ID to `vars` in your config: ```jsonc title="wrangler.production.jsonc" "MS_CLIENT_ID": "" ``` Then deploy with `bun run deploy`. If you used the Deploy button, change `MS_CLIENT_ID` in your repository's `wrangler.jsonc` and push instead, and run the two `secret put` commands with `--name ` in place of `--config`. Never put `MS_CLIENT_SECRET` or `ONEDRIVE_TOKEN_KEY` in `vars`. The deploy script refuses a config that does. ## Connect and choose the folder 1. **Connect your Microsoft account** In the app, open **Settings > Sending** and, under **OneDrive**, press **Connect**. Sign in to Microsoft and accept the permissions. You come back to Settings with "Microsoft account connected." 2. **Choose the folder** In OneDrive, open the destination folder's **Share** menu and choose **Copy link**. Paste it into **Shared folder link** and press **Use folder**. To pick another folder later, open **Change folder**. For a folder shared from another organisation, open the link once in your browser while signed in first. If the link still does not resolve, also type the folder's name in **Folder name**. ## Upload a month 1. Open **Home** and pick the month. When **Send** is ready, the upload button replaces the download as the main button. 2. Press **Upload to** your folder. The files go into a subfolder named like the ZIP, for example `receipts-2026-10`. 3. Ten files go up per request. If more remain, the page shows how many are done, such as "4 of 12 uploaded."; press **Continue upload** until all are up. When everything is up, the banner says "Uploaded to OneDrive. Marked as sent." ## Check it worked - **Settings > Sending > OneDrive** shows your **Account** and the chosen **Folder**. - The subfolder in OneDrive holds the originals and the index spreadsheet, with the same names and `check-these/` rules as the ZIP. If Microsoft asks the app to slow down, the page says how many seconds to wait before you continue. Files already uploaded are skipped next time; corrected ones replace their old copy. ## When something stops working - **"`MS_CLIENT_SECRET` or `ONEDRIVE_TOKEN_KEY` is missing."** under **Settings > Sending > OneDrive**: `MS_CLIENT_ID` is set but one of the two secrets is not. - **Sign-in fails after months of working**: the client secret has expired. Create a new one in Entra and store it with `wrangler secret put MS_CLIENT_SECRET` again. - **Asked to reconnect**: Microsoft ends a sign-in after 90 days without use. Press **Connect** again. - **The other organisation blocks outside accounts**: only the ZIP works for that folder, and Settings says so. To stop, press **Disconnect** under **OneDrive**, then **Disconnect** again to confirm. This deletes the stored sign-in and the upload records from the app. ## Related - [Send the month to your accountant](/docs/how-to/send-the-month-to-your-accountant/) - [Month package](/docs/reference/month-package/) for the file names and folder layout. - [Outside calls](/docs/reference/outside-calls/) for what goes to Microsoft and when. - [Configuration](/docs/reference/configuration/) for `MS_CLIENT_ID`, `MS_CLIENT_SECRET` and `ONEDRIVE_TOKEN_KEY`. Source: https://receipts.nuits.net/docs/how-to/upload-the-month-to-onedrive/index.mdx