# How to create an OAuth app in MYOB

MYOB Business uses OAuth 2.0 (authorization code). To run the connector in production you register
your own app with MYOB and paste its credentials into the Apideck Dashboard, so the consent screen
your consumers see carries **your** app name and the OAuth relationship stays in your name.

Apideck also ships test credentials for MYOB, which is the fastest way to evaluate the connector:
you can authorize a MYOB company file straight away without registering anything, and the consent
screen shows "Apideck". Use those for evaluation only. Register your own app before you go live.

Registering an app with MYOB and calling the API does **not** require a paid program membership.
The MYOB Developer Program is a separate, optional add-on covered in step 7.

Before you start, you'll need a **my.MYOB** account. If you already own a MYOB product you have
one; if not, applying for API access creates a MYOB login for you.

## 1. Get API access and sign in to my.MYOB

1. Apply for API access from MYOB's
   [Getting started with the MYOB Business API](https://developer.myob.com/api/myob-business-api/api-overview/getting-started/)
   page. MYOB creates a MYOB login for you if you do not already have one.
2. Sign in to [my.MYOB](https://my.myob.com.au/Pages/Default.aspx) with that login.

## 2. Register the app

In my.MYOB, open the **Developer** tab and click **Register App**. The registration form asks for
two things:

- **App name**: this is the name your consumers see on the MYOB consent screen, so use a name they
  will recognise.
- **Redirect URL**: see the next step.

## 3. Set the redirect URL

Enter exactly:

```
https://unify.apideck.com/vault/callback
```

MYOB matches the redirect URI on each authorization request against the value registered with the
app, so it must be character-for-character identical: no trailing slash, no query parameters, no
fragment.

## 4. Copy the API key and API secret

When you save the registration, MYOB generates and displays the app's **API key** and **API
secret** on the page.

MYOB's naming differs from the usual OAuth vocabulary, and this is the single most common source of
confusion on this connector:

| MYOB calls it | It is your | Where it goes in Apideck |
| ------------- | ---------- | ------------------------ |
| API key | OAuth **client id** (MYOB passes it as `client_id` on the authorize request) | **Client ID** |
| API secret | OAuth **client secret** | **Client Secret** |

The API key does double duty: MYOB also requires it as an `x-myobapi-key` header on every API call.
You do not configure that separately. See step 5.

## 5. Enter the credentials in the Apideck Dashboard

Open the [Apideck MYOB connector settings](https://platform.apideck.com/configuration/accounting/myob)
in the Apideck Dashboard, choose to use your own client credentials, and paste in:

- **Client ID**: the API key from step 4
- **Client Secret**: the API secret from step 4

That is the whole credential configuration. Two MYOB-specific details are handled for you:

- **`x-myobapi-key`**: Apideck re-sends your client id as this header on every request, so the
  API key never has to be entered twice.
- **`x-myobapi-version`**: pinned to `v2` by the connector.

**Scopes.** The connector requests the `CompanyFile` scope. MYOB's app registration form has no
scope selection: scopes are requested per authorization request, so there is nothing to tick on
the MYOB side. MYOB also publishes granular `sme-*` scopes
([scopes reference](https://developer.myob.com/api/myob-business-api/api-overview/scopes/)); only
change the connector's scope list if MYOB has told you your app requires them.

If you ever regenerate the app's API secret in my.MYOB, paste the new value into the connector
settings straight away: existing connections stop refreshing until the stored secret matches the
app again.

## 6. What your consumers do next

Once your credentials are saved, each consumer authorizes MYOB in Vault and then **selects a
Company File**. That choice determines the base URL for all of their subsequent API calls, so a
consumer with several company files needs a separate connection for each one. The company file list
is read from the consumer's own MYOB account, so it only contains files their MYOB user can access,
nothing for you to configure per consumer. The consumer-facing walkthrough is in the
[MYOB connection guide](consumer+connection).

MYOB access tokens are short-lived (20 minutes) and Apideck refreshes them automatically; refresh
tokens have no fixed expiry in the connector configuration.

MYOB's request limits are counted **per API key**, which means every connection authorized through
your app draws on the same quota. The current figures are in the At a Glance section of the
connector Overview, worth a look before you plan high-volume sync schedules.

## 7. Optional: join the MYOB Developer Program

The paid MYOB Developer Program is optional (see above). What it includes and what each tier costs
are in the At a Glance section of the connector Overview and on MYOB's pages below.

Membership is a tiered monthly subscription; current tiers and pricing are on MYOB's
[developer program details](https://developer.myob.com/developer-program-details/) page, and the
[become a MYOB developer partner](https://developer.myob.com/become-a-myob-developer-partner/) page
explains what each tier includes. Apply via MYOB's
[developer program application form](https://apisupport.myob.com/hc/en-us/requests/new?ticket_form_id=13228298199055),
and ask your MYOB contact for an expected timeline on the application.

Without the program you can still develop and test. See the testing options in the MYOB
Overview's Environment Clarity section.

## 8. Security requirements

MYOB's DSPANZ-aligned security requirements apply to all consumers of MYOB's data; Developer
Program membership doesn't change this, and neither does skipping the program. In summary, MYOB
requires:

- OAuth 2.0 for authentication,
- refresh tokens encrypted at rest (AES-128 or stronger, or 3DES),
- TLS 1.2 or higher for data in transit,
- multi-factor authentication on user logins (or MYOB SSO with MFA enabled),
- encryption at rest for sensitive data.

The authoritative and current list is MYOB's
[security requirements](https://developer.myob.com/program/security-requirements/) page. A partner
who cannot meet a requirement must notify MYOB in writing with a remediation plan, so raise any gap
with MYOB early rather than at review time.

## FAQ and troubleshooting

### Error: invalid redirect URI

The redirect URL registered on your MYOB app must be exactly
`https://unify.apideck.com/vault/callback`. MYOB compares it character for character against the
value sent on the authorization request: a trailing slash or an extra parameter is enough to fail.

### The consent screen shows "Apideck" instead of my app name

The connection is using Apideck's test credentials. Enter your own Client ID and Client Secret
under **Use your own client credentials** in the
[Apideck MYOB connector settings](https://platform.apideck.com/configuration/accounting/myob), then
have the consumer authorize again: the app name comes from your MYOB app registration (step 2).

### Authorization fails immediately, or calls return 401

Check that the **Client ID** is the app's **API key** and not the API secret (step 4). MYOB
validates the same value twice, as `client_id` on the authorize request and as the `x-myobapi-key`
header on API calls, so a swapped or mistyped pair fails at both points.

### Authorization succeeds but there is no Company File to select

The company file list comes from the authorizing MYOB user's own access, not from your app. Ask the
consumer to authorize with a MYOB user who has access to the company file they want to connect.

### A connection stopped working

Apideck refreshes MYOB tokens automatically. If a connection stops refreshing, the usual causes are
a regenerated API secret that has not been updated in the connector settings (step 5) or a
consumer-side revocation. The fix in both cases is to correct the credential and ask the consumer to
authorize MYOB again in Vault.

Still stuck? Contact [Apideck Support](https://help.apideck.com/en/articles/7774658).