Xero

Overview

Connect your users to Xero for accounting, invoicing, and bank reconciliation.

Property	Value
Provider ID	xero
Category	Finance
PKCE	Supported (S256)
Token refresh	Automatic (rotating refresh tokens, requires offline_access)
Redirect URI	Shown in Developer Portal

Step 1: Create a Xero App

Go to the Xero Developer Portal

Navigate to My Apps in the Xero Developer Portal and sign in.

Create a new app

Click New app, enter the app name, and choose Web app as the integration type.

Configure the application

Enter the company or application URL and add the Alter callback URL (from the Developer Portal) to the Redirect URI field.

Get credentials

Open the app’s Configuration page, copy the Client ID, and generate a Client Secret. The secret is only shown once.

Warning

Never share your Client Secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Xero provider

Go to OAuth Providers > Add Provider > Xero.

Enter credentials

• Client ID: Paste your Xero Client ID
• Client Secret: Paste your Xero Client Secret

Select scopes

Choose the scopes the application needs. Always include offline_access.

Save

Click Save. The provider is now active.

Available Scopes

Identity

Scope	Description
openid	Authenticate with Xero via OpenID Connect
profile	The user’s first name and last name
email	The user’s email address
offline_access	Issue a refresh token so access continues after the 30-minute access token expires

Accounting

Scope	Description
accounting.contacts.read	Read-only access to customers and suppliers
accounting.contacts	Read/write access to customers and suppliers
accounting.invoices.read	Read-only access to invoices, credit notes, quotes, purchase orders, and items
accounting.invoices	Read/write access to invoices, credit notes, quotes, purchase orders, and items
accounting.payments.read	Read-only access to payments, batch payments, overpayments, and prepayments
accounting.payments	Read/write access to payments, batch payments, overpayments, and prepayments
accounting.banktransactions.read	Read-only access to bank transactions and bank transfers
accounting.banktransactions	Read/write access to bank transactions and bank transfers
accounting.manualjournals.read	Read-only access to manual journals
accounting.manualjournals	Read/write access to manual journals
accounting.settings.read	Read-only access to organisation settings, the chart of accounts, and tax rates
accounting.settings	Read/write access to organisation settings, the chart of accounts, and tax rates
accounting.attachments.read	Read-only access to attachments on accounting documents
accounting.attachments	Read/write access to attachments on accounting documents
accounting.journals.read	Read-only access to the accounting journal
accounting.budgets.read	Read-only access to budgets
accounting.reports.aged.read	Read-only access to aged receivables and aged payables reports

Other APIs

Scope	Description
files.read / files	Read-only / read-write access to files and folders
assets.read / assets	Read-only / read-write access to fixed assets
projects.read / projects	Read-only / read-write access to projects and time entries

Additional scopes

Scope	Description
files.read	Read-only access to files and folders
files	Read/write access to files and folders
assets.read	Read-only access to fixed assets
assets	Read/write access to fixed assets
projects.read	Read-only access to projects and time entries
projects	Read/write access to projects and time entries

Notes

• Always request offline_access — Xero access tokens expire after 30 minutes and the refresh token is the only way to keep the grant alive.
• Xero rotates refresh tokens on every refresh. Alter Vault stores the latest token automatically.
• Apps created on or after March 2, 2026 must use the granular accounting scopes shown above; the broad accounting.transactions and accounting.reports.read scopes are rejected for new apps and retire in September 2027.
• Each user grants access to one or more Xero organisations at consent time; API calls carry a xero-tenant-id header identifying the organisation.
• Uncertified apps are limited to 25 connected organisations.
• See the Xero OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
getOrganisations	read	GET	/api.xro/2.0/Organisation
getAccounts	read	GET	/api.xro/2.0/Accounts
getInvoices	read	GET	/api.xro/2.0/Invoices
getInvoice	read	GET	/api.xro/2.0/Invoices/{InvoiceID}
createInvoices	write	PUT	/api.xro/2.0/Invoices
updateOrCreateInvoices	write	POST	/api.xro/2.0/Invoices
updateInvoice	write	POST	/api.xro/2.0/Invoices/{InvoiceID}
emailInvoice	send	POST	/api.xro/2.0/Invoices/{InvoiceID}/Email
getContacts	read	GET	/api.xro/2.0/Contacts
getContact	read	GET	/api.xro/2.0/Contacts/{ContactID}
createContacts	write	PUT	/api.xro/2.0/Contacts
updateContact	write	POST	/api.xro/2.0/Contacts/{ContactID}
getPayments	read	GET	/api.xro/2.0/Payments
createPayment	payment, write	POST	/api.xro/2.0/Payments
createPayments	payment, write	PUT	/api.xro/2.0/Payments
deletePayment	delete, payment	POST	/api.xro/2.0/Payments/{PaymentID}
getBankTransactions	read	GET	/api.xro/2.0/BankTransactions
createBankTransactions	write	PUT	/api.xro/2.0/BankTransactions
updateBankTransaction	write	POST	/api.xro/2.0/BankTransactions/{BankTransactionID}
getCreditNotes	read	GET	/api.xro/2.0/CreditNotes
createCreditNotes	write	PUT	/api.xro/2.0/CreditNotes
getQuotes	read	GET	/api.xro/2.0/Quotes
createQuotes	write	PUT	/api.xro/2.0/Quotes