← Integrations

Xero

Read and write an organisation's Xero contacts, invoices and transactions.

View on GitHub →

How to use it

This profile ships with Kirak. Add "integrations" to modules in kirak.json, then name the profile as below. There is nothing to download, and a copy in your project's integrations/ folder is an error.

Environment variables

VariableHolds
KIRAK_INTEGRATION_XERO_CLIENT_SECRETThe OAuth client secret from the vendor's console. Secret: keep it out of kirak.json and out of source control.
KIRAK_AUTH_ENCRYPTION_KEYSEncrypts stored tokens. Shared by every integration; the module refuses to start without it.

The names follow the integration's name in kirak.json (xero here). Name it something else, such as xero_sales, and the variables change to match.

Redirect URL

Register this as the redirect (callback) URL in the vendor's console, with your app's address in place of <your-app> (the base_url in kirak.json):

https://<your-app>/integrations/xero/callback

How to get your keys

  1. Open My Apps on the Xero developer site and choose New app, of type Web app.
  2. Set the redirect URI to https://<your-app>/integrations/xero/callback.
  3. Copy the client ID, then generate a client secret and copy it.
  4. Put the client ID in kirak.json as integrations.providers.xero.client_id, and the client secret in the environment as KIRAK_INTEGRATION_XERO_CLIENT_SECRET. Never put the secret in kirak.json.
  5. The default scopes are: accounting.transactions.read (Read invoices, bills and payments), accounting.contacts.read (Read contacts), offline_access (added by Kirak so it gets a refresh token). An app that is not a Xero partner is limited to 25 connected organisations.

The vendor's own guide · Instructions out of date? ·Suggest an edit

kirak.json

Scopes
{
  "integrations": {
    "providers": {
      "xero": {
        "type": "oauth2",
        "profile": "xero",
        "client_id": "your-client-id",
        "scope": [
          "accounting.transactions.read",
          "accounting.contacts.read"
        ]
      }
    }
  }
}

Merged into the profile: scope replaces the profile's default scopes, and offline_access is always added so Kirak gets a refresh token.

Good to know

  • Xero limits this kind of app to 25 connected accounts; Kirak refuses connects past that.
  • Every API call must send the xero-tenant-id header with the organisation's id. The engine does not send it yet (IN9.2), so calls fail until it does.
  • The account is the first organisation the user authorised.
  • Not verified against the vendor docs in this session: check the facts before release.

Help improve this profile

Report a problem ·Suggest an edit to profile.json ·Add a profile ·Vendor docs the profile was checked against

Product names and logos are trademarks of their respective owners. Their use does not imply endorsement. To ask for this icon to be removed, email trademark@kirak.io.

Ask about Kirak on