Xero API integration for your shop, CRM and apps

What you can connect to Xero

Xero's Accounting API covers invoices, bills, payments, bank transactions, contacts, items and manual journals, with separate Payroll, Files and Assets APIs alongside it. The useful question is which flow is costing you hours or errors today.

These are the flows a UK or Irish SME on Xero would typically look at:

• Shopify or your online shop: orders become invoices with the right tax rates, and payouts are matched against fees. For trade customers with their own prices, a B2B ecommerce and trade ordering portal can post orders straight into Xero.
• HubSpot or your CRM: when a deal is won, the contact and the invoice appear in Xero, and payment status flows back so sales can see who has paid.
• Client portal: customers download invoices and statements and see what they owe without phoning you. See client portal development.
• Job sheets: an engineer closes a job on the phone and Xero receives a draft invoice with hours and materials.
• Supplier bills: PDFs arriving by email are read by AI and created as draft bills for someone to approve. See AI invoice data extraction.

How the Xero API works: OAuth 2.0, scopes and Custom Connections

There are no API keys. According to Xero's developer FAQs, the API uses OAuth 2.0: you register an app, receive a client ID and secret, and a Xero user authorises the connection to their organisation. Desktop and mobile apps that cannot keep a secret use the PKCE extension.

Access tokens last 30 minutes. Unused refresh tokens expire after 60 days, so an integration that sits idle for two months needs someone to authorise it again. Rotating tokens safely, and alerting someone when a refresh fails, is part of the build.

Permissions are moving to granular scopes. Apps created on or after 2 March 2026 use them by default (for example accounting.invoices instead of the broad accounting.transactions), and older apps have until September 2027 to migrate.

For an integration with one organisation, Xero offers Custom Connections: machine-to-machine access with the client credentials grant and no refresh tokens. Xero lists the price as £5 a month (ex VAT) per connection, paid by the Xero subscriber, and availability for organisations in Australia, New Zealand, the UK and the US only. Irish organisations therefore use the standard OAuth flow. Custom Connections created from 29 April 2026 use granular scopes, which do not include the Journals endpoint.

Xero API rate limits

Limits apply to each connected organisation, and Xero's FAQ says they cannot be increased. These are the figures Xero publishes in its limits FAQ and pricing page (checked on 5 November 2026; they can change):

Every response carries X-DayLimit-Remaining and X-MinLimit-Remaining headers, and going over returns HTTP 429 with a Retry-After header. A well-built integration reads both, pages through lists (100 records per page on invoices, contacts and bank transactions) and uses If-Modified-Since to fetch only what has changed.

Xero webhooks: let Xero tell you what changed

Instead of polling, the integration can subscribe to webhooks. Xero's official webhooks specification lists events for contacts, invoices, credit notes, payments, prepayments, overpayments and app subscriptions, each for create and update. Credit note events reached general availability in March 2026.

Each delivery carries a hashed signature in the x-xero-signature header, which your endpoint must check before trusting the payload. The event holds the record's ID and a URL to fetch it, not the full record, so every webhook still costs an API call to read the details. Count those calls before you start.

What Xero charges for API access since March 2026

On 2 March 2026 Xero replaced its revenue-share model with five developer plans, priced on connections and on data egress (data read out of Xero). Xero publishes the fees in Australian dollars; the sterling figures are our conversion at the European Central Bank reference rates of 4 November 2026 and are approximate.

For a single business, the choice is usually between a Custom Connection (which Xero says stays on its existing commercial terms) and a standard app on one of these plans. Higher plans also require app certification, and the top ones a security assessment. Xero's updated developer terms also prohibit using data obtained through its APIs to train AI or machine-learning models. We check which route and plan fits your volume in discovery, against Xero's pricing page on the day.

Xero integration with Claude or ChatGPT

Xero now runs an official Remote MCP server (api.xero.com/mcp/v1) so AI assistants and agents can read and write Xero data through tools. It signs in with OAuth 2.0 and PKCE, has the same rate limits as the API, and works with any MCP-compatible client, including Claude Desktop, Claude Code, Cursor and VS Code. Real organisations need the Core plan or above; Starter apps can only use it with the demo company. There is also an open-source Xero MCP server in Xero's GitHub account, and Xero's FAQ refers to a separate Xero connector in Claude.

Two details matter for a business process. Xero's FAQ says the version 1 tools do not ask for confirmation before writing, and only the API calls are logged, not the prompts behind them. For one person querying their own books, that may be enough. For an AI agent connected to your systems that posts bills or chases payments, we add minimum scopes, a human check on anything doubtful and our own log of every action. Whether model providers train on your data is covered in our FAQ.

Xero App Store connector, Zapier or a bespoke integration

The UK Xero App Store already lists Xero's own free Shopify integration, Data sync by HubSpot and CRMs such as Capsule, plus a directory of development partners. Xero says it cannot guarantee listed apps, so test on the demo company first. If a connector does the job, we will tell you, and you should not pay for development.

Risks of a Xero integration, and how we approach it

Most problems surface weeks after go-live. With Xero, these are the usual ones:

• Duplicates: a retried call creates two invoices. We store an external reference (the shop order number) and check it before writing.
• Two-way sync: if prices can change in the shop and in Xero, one overwrites the other. We agree in writing which system owns each field.
• Contacts and items: the same customer twice, SKUs that do not match, wrong tax rates. They are cleaned and matched before syncing, not after.
• Draft or authorised: decide which invoices Xero receives as drafts for a person to approve and which go straight through.
• Expired authorisations: a refresh token unused for 60 days, or a scope change, silently stops the sync. Every call is logged, retries are automatic and a person gets an alert with the record and the reason.

We start with a short discovery: which flows, which Xero plan or Custom Connection, how many calls your real volume needs and which system owns each field. Then you get one fixed price per project, a working demo every two weeks and the code in your own repository; the details are in how we work. SocketStack is not a Xero partner and is not listed in the Xero App Store; we work with Xero's public API. For budgets, read how much custom software costs, see the full ERP and CRM integration service or, if you also run Sage, our Sage integration page.