How to create an OAuth app in MYOB

MYOB Business uses OAuth 2.0 (authorization code). To run the connector in production you register your own app with MYOB and paste its credentials into the Apideck Dashboard, so the consent screen your consumers see carries your app name and the OAuth relationship stays in your name.

Apideck also ships test credentials for MYOB, which is the fastest way to evaluate the connector: you can authorize a MYOB company file straight away without registering anything, and the consent screen shows "Apideck". Use those for evaluation only — register your own app before you go live.

Registering an app with MYOB and calling the API does not require a paid program membership. The MYOB Developer Program is a separate, optional add-on covered in step 7.

Before you start, you'll need a my.MYOB account. If you already own a MYOB product you have one; if not, applying for API access creates a MYOB login for you.

Apply for API access from MYOB's Getting started with the MYOB Business API page. MYOB creates a MYOB login for you if you do not already have one.
Sign in to my.MYOB with that login.

2. Register the app

In my.MYOB, open the Developer tab and click Register App. The registration form asks for two things:

App name — this is the name your consumers see on the MYOB consent screen, so use a name they will recognise.
Redirect URL — see the next step.

3. Set the redirect URL

Enter exactly:

https://unify.apideck.com/vault/callback

MYOB matches the redirect URI on each authorization request against the value registered with the app, so it must be character-for-character identical — no trailing slash, no query parameters, no fragment.

4. Copy the API key and API secret

When you save the registration, MYOB generates and displays the app's API key and API secret on the page.

MYOB's naming differs from the usual OAuth vocabulary, and this is the single most common source of confusion on this connector:

MYOB calls it	It is your	Where it goes in Apideck
API key	OAuth client id (MYOB passes it as `client_id` on the authorize request)	Client ID
API secret	OAuth client secret	Client Secret

The API key does double duty: MYOB also requires it as an x-myobapi-key header on every API call. You do not configure that separately — see step 5.

5. Enter the credentials in the Apideck Dashboard

Open the Apideck MYOB connector settings in the Apideck Dashboard, choose to use your own client credentials, and paste in:

Client ID — the API key from step 4
Client Secret — the API secret from step 4

That is the whole credential configuration. Two MYOB-specific details are handled for you:

x-myobapi-key — Apideck re-sends your client id as this header on every request, so the API key never has to be entered twice.
x-myobapi-version — pinned to v2 by the connector.

Scopes. The connector requests the CompanyFile scope. MYOB's app registration form has no scope selection — scopes are requested per authorization request, so there is nothing to tick on the MYOB side. MYOB also publishes granular sme-* scopes (scopes reference); only change the connector's scope list if MYOB has told you your app requires them.

If you ever regenerate the app's API secret in my.MYOB, paste the new value into the connector settings straight away — existing connections stop refreshing until the stored secret matches the app again.

6. What your consumers do next

Once your credentials are saved, each consumer authorizes MYOB in Vault and then selects a Company File. That choice determines the base URL for all of their subsequent API calls, so a consumer with several company files needs a separate connection for each one. The company file list is read from the consumer's own MYOB account, so it only contains files their MYOB user can access — nothing for you to configure per consumer. The consumer-facing walkthrough is in the MYOB connection guide.

MYOB access tokens are short-lived (20 minutes) and Apideck refreshes them automatically; refresh tokens have no fixed expiry in the connector configuration.

MYOB's request limits are counted per API key, which means every connection authorized through your app draws on the same quota. The current figures are in the At a Glance section of the connector Overview — worth a look before you plan high-volume sync schedules.

7. Optional: join the MYOB Developer Program

The paid MYOB Developer Program is optional (see above). What it includes and what each tier costs are in the At a Glance section of the connector Overview and on MYOB's pages below.

Membership is a tiered monthly subscription; current tiers and pricing are on MYOB's developer program details page, and the become a MYOB developer partner page explains what each tier includes. Apply via MYOB's developer program application form, and ask your MYOB contact for an expected timeline on the application.

Without the program you can still develop and test — see the testing options in the MYOB Overview's Environment Clarity section.

8. Partner security requirements

If you join the Developer Program, MYOB holds partners to DSPANZ-aligned security requirements. In summary, MYOB requires:

OAuth 2.0 for authentication (no company-file username/password auth),
refresh tokens encrypted at rest (AES-128 or stronger, or 3DES),
TLS 1.2 or higher for data in transit,
multi-factor authentication on user logins (or MYOB SSO with MFA enabled),
encryption at rest for sensitive data.

The authoritative and current list is MYOB's security requirements page. A partner who cannot meet a requirement must notify MYOB in writing with a remediation plan, so raise any gap with MYOB early rather than at review time.

FAQ and troubleshooting

Error: invalid redirect URI

The redirect URL registered on your MYOB app must be exactly https://unify.apideck.com/vault/callback. MYOB compares it character for character against the value sent on the authorization request — a trailing slash or an extra parameter is enough to fail.

The connection is using Apideck's test credentials. Enter your own Client ID and Client Secret under Use your own client credentials in the Apideck MYOB connector settings, then have the consumer authorize again — the app name comes from your MYOB app registration (step 2).

Authorization fails immediately, or calls return 401

Check that the Client ID is the app's API key and not the API secret (step 4). MYOB validates the same value twice — as client_id on the authorize request and as the x-myobapi-key header on API calls — so a swapped or mistyped pair fails at both points.

Authorization succeeds but there is no Company File to select

The company file list comes from the authorizing MYOB user's own access, not from your app. Ask the consumer to authorize with a MYOB user who has access to the company file they want to connect.

A connection stopped working

Apideck refreshes MYOB tokens automatically. If a connection stops refreshing, the usual causes are a regenerated API secret that has not been updated in the connector settings (step 5) or a consumer-side revocation. The fix in both cases is to correct the credential and ask the consumer to authorize MYOB again in Vault.

Still stuck? Contact Apideck Support.