How to connect Xero

For most people, connecting Xero is one action: click Authorize, sign in to Xero, and allow access for the organisation this connection is for. There are no credentials to copy and paste. Apideck runs the OAuth flow and refreshes the short-lived access token afterwards, so the connection keeps working without you re-entering anything.

The connection also carries a Default Tenant setting, which decides the Xero organisation every request targets. When your authorization covers exactly one organisation, Apideck sets it for you right after Xero redirects you back, and you are done. You only pick it yourself when the authorization covers several organisations, or when you later want an existing connection to read a different one (see step 2).

Prerequisites

• An active Xero subscription. Any plan works, and no add-on module is needed: standard Xero subscriptions include everything this connector reads and writes.
• A Xero user account with the Standard or Adviser role on the organisation you want to connect. An app gets the access of the user who authorizes it, so authorize with an account that already has the access the integration needs. Xero's permissions FAQ notes that some data, including manual journals and report-derived figures, additionally requires that user to have Reports access, which is why an adviser or administrator-level account is the safer choice.
• Knowing which organisation this connection is for. If your Xero login reaches more than one organisation, you choose one during the flow, and each organisation needs its own connection (see step 3).
• A free app slot on that organisation, if this integration is not Xero-certified. Xero allows each organisation two connected apps that are not certified by Xero at a time. Certified apps do not count towards it. If your organisation is already at two, freeing a slot first saves a failed attempt (see Troubleshooting).

1. Authorize with Xero

1. Open the Xero connection in Apideck Vault.
2. Click Authorize. You are redirected to Xero to sign in.
3. Sign in with the Xero account this connection should use. You type those details on Xero's own sign-in page, they are used only to complete this flow, and the integration never sees them.
4. On Xero's access screen, select the organisation to connect, review the access being requested, and allow it.

You are never asked for a client ID, a client secret, or a redirect URL. Those belong to the Xero app registered by the provider of the integration you are setting up.

2. Default Tenant: automatic for a single organisation

After Xero redirects you back, Apideck reads the organisations your authorization covers and uses them as the options on the connection's Default Tenant setting.

• One organisation authorized (the usual case): Apideck selects it automatically. There is nothing further to do, and the connection is ready to use.
• Several organisations authorized: open the Default Tenant dropdown, select the organisation this connection should use, and click Save.

You can return to this setting later to point an existing connection at a different organisation your authorization already covers: select the other organisation and save.

3. One connection per organisation

A connection is anchored to a single Xero organisation. If the integration needs data from several organisations, create a separate connection for each one and run Authorize again for it, selecting the next organisation on Xero's access screen. There is no way to cover several organisations from one connection.

Notes

• Token refresh is automatic. Apideck refreshes the short-lived access token for you. There is nothing to re-enter while the connection is in regular use.
• A connection left unused for 60 days needs re-authorizing. Xero expires the stored refresh token after 60 days without use. Regular use keeps it alive, so this only affects dormant connections: restore one by opening it in Vault and clicking Authorize again.
• Your access governs the connection's access. What the connection can read and write follows the Xero role and organisation access of the user who authorized it, and some data additionally requires that user to have Reports access (Xero permissions FAQ). Authorizing with an account that already holds the access the integration needs avoids gaps later.
• You can review or revoke the connection from inside Xero at any time. Click the organisation name, then Settings, then Connected apps. Xero's guide to reviewing and disconnecting connected apps covers it. Disconnecting there stops the integration receiving new data immediately.
• A 429 response is a rate-limit answer, not a broken connection. Xero meters calls per organisation and per app, and Apideck passes Xero's rate-limit and retry headers through so the integration can back off and retry. The current limits are listed in this connector's overview.

Troubleshooting

Xero will not let me connect the app, or says the organisation has too many connected apps. To free a slot, click the organisation name in Xero, then Settings, then Connected apps, and disconnect an uncertified app you no longer use, following Xero's guide to reviewing and disconnecting connected apps. Then run Authorize again. If every connected app is still in use, tell the provider of the integration: whether their app is certified by Xero is theirs to pursue, and certified apps are not subject to this limit.

The organisation I want is not on Xero's access screen. The Xero account you signed in with does not have access to it, or you were still signed in to a different Xero account. Sign out of Xero, sign in with the right account, and run Authorize again. If the account should have access, ask an administrator of that Xero organisation to invite it with the Standard or Adviser role first.

I want to change organisation, but the Default Tenant dropdown has no options. Its options come from Xero and cover only the organisations your current authorization includes. Reload the connection in Vault, and if the list is still empty, run Authorize again and confirm you selected an organisation on Xero's access screen. To reach an organisation the authorization never covered, create a separate connection for it (step 3).

The connection works, but returns another organisation's data. Check the Default Tenant selection on the connection: that is the organisation being read and written. Change it and save, or create a separate connection for the other organisation (step 3).

Ledger account balances come back empty. Balances are read from a Xero report, and a connection authorized before 18 August 2026 predates that permission being requested. Open the connection in Vault and click Authorize again. If balances are still empty afterwards, report it to the provider of the integration: which permissions their Xero app requests is set on their side.

The connection worked and later stopped. The usual causes, in order:

1. It sat unused for more than 60 days, so re-authorize (see Notes).
2. Someone disconnected the app in Xero under Settings, then Connected apps, so re-authorize.
3. The Xero access of the user who authorized it changed, so re-authorize with an account that has the access the integration needs (see Notes).
4. The Xero app credentials behind the integration changed. Those are held by the provider of the integration, not by you, and every connection using them is affected, so report it to them.

Still stuck? Contact Apideck Support.