Inside a Xero Integration: OAuth, Rate Limits, Mapping and Reconciliation
Every Xero or MYOB integration solves the same four problems: authentication, rate limits, data mapping and reconciliation, whatever system sits on the other end.
Quick answer:A Xero integration authenticates via OAuth 2.0, respects API rate limits, maps records to Xero's objects, then reconciles postings with a human exception queue.
- accounting system integration
- API integration architecture
- e-commerce and finance integration
Quick answer
What does integrating Xero with another system actually involve?
A Xero integration authenticates through OAuth 2.0, maps each record type to Xero's contacts, invoices and payments objects, then posts and reconciles those records against bank data with a step for a human to review exceptions.
Additional Context
The same pattern applies whether the source system is a Shopify store, a booking engine or a client portal. Accounting stays the system of record; the integration keeps it accurate, and those records then need to be kept for 5 years under ATO rules.
Sources
- ATO: Overview of record-keeping rules for business
Businesses must keep most business records for 5 years.
Xero API integration
How a Xero integration actually works
Xero authenticates every connection through OAuth 2.0. A client application registers with Xero, a user grants consent through a standard Xero login screen, and the integration receives an access token that expires quickly, alongside a refresh token it uses to stay connected without asking the user to log in again. Any system calling the Xero API has to handle that token refresh cycle correctly, because a missed refresh is a frequent reason a working integration quietly stops posting invoices, often for weeks before anyone notices.
Xero's API applies rate limits per organisation and per minute, so a high-volume connector, one syncing thousands of Shopify orders overnight for example, needs to queue and throttle calls so it doesn't overwhelm the API when the source system produces records quickly. This is where the architecture decision matters: a thin direct connection to the Xero API works well for a handful of record types, while a business syncing several systems into Xero at once often does better with dedicated middleware integration that can queue, retry and log failures centrally.
Once a record reaches Xero, the harder problem starts: mapping. A Shopify order, a booking-system invoice or a CRM deal each carry their own idea of a customer, a line item and a tax treatment, and all of it has to resolve to Xero's contact, invoice and payment objects without creating duplicate contacts or mismatched tax codes. Good REST API development practice handles this with an idempotency key on every write, so a retried call updates the existing record instead of creating a second one.
Why this matters
The reconciliation gap manual bookkeeping creates
Problem
Each order, booking or deal logged in Shopify, a booking system or a CRM has to be re-entered into Xero or MYOB by hand, and every manual entry is a chance for a tax code, a customer match or an amount to go wrong before the bank reconciliation ever runs.
Common Pain Points:
- Double entry Staff key the same order or booking into Xero or MYOB a second time, and the two records can drift apart.
- Silent mapping failures An unmapped tax code or a new customer name can post wrong without anyone noticing until reconciliation.
- Rate limit throttling A connector built without throttling in mind can hit Xero's API limits during a sales spike and fall behind.
Business Impact:
Time Wasted: A task someone repeats every time a sale happens, rather than a one-off job that gets automated away.
Cost Implication: Errors surface at tax time or during an audit, often weeks after the transaction that caused them.
Opportunity Cost: The person doing manual entry is doing it instead of chasing debtors or closing the month.
Solution
An API integration posts invoices, payments and contacts to Xero or MYOB automatically, with mapping rules for tax codes and customers, and a review queue for anything the mapping can't resolve.
Our Approach:
- Map the data model (Discovery)
Agree how each source record, an order, a booking, a deal, maps to a Xero or MYOB contact, invoice and tax code, including edge cases like partial refunds and multi-currency orders.
- Build and authenticate the connector (Build)
Register the integration with Xero's or MYOB's developer platform, implement the OAuth flow and token refresh, and build the posting logic with retry and idempotency built in.
- Reconcile and gate exceptions (Testing)
Run the connector against real transactions, matching postings to the bank feed automatically and routing anything that doesn't match, a missing customer, an unrecognised tax code, into a logged human review queue so nothing fails silently.
- Hand over and monitor (Go-live)
Move the connector into production with logging and alerting in place so a failed sync is caught the same day, not discovered a month later at reconciliation.
Expected Outcome: Invoices, payments and contacts flow into Xero or MYOB without manual re-entry, and exceptions land in a queue someone checks rather than causing a silent mismatch.
Key Takeaways
What to get right in a Xero or MYOB integration
- OAuth 2.0 token refresh is a frequent cause of a Xero integration that quietly stops workingCritical
Xero access tokens expire quickly, and a connector that mishandles the refresh token will keep running but stop posting, often for weeks before anyone notices.
- Rate limits shape the architecture, not just the codeImportant
A connector syncing a high order volume needs to queue and throttle calls; for several systems feeding Xero at once, that usually means middleware handling the traffic centrally.
- Mapping, not the API call, is where most integration effort goesCritical
Resolving a source record's customer, tax code and currency to Xero's own objects without creating duplicates takes more design work than the authentication and posting logic combined.
- Reconciliation needs a human exception queue, not a silent failureImportant
A record the mapping can't resolve should land somewhere a person checks. Skipping it, retrying it into a duplicate, or dropping it without a trace are the usual failure modes to design against.
Getting a Xero or MYOB integration right means treating OAuth, rate limits, data mapping and reconciliation as four separate problems, each with its own failure mode to design against.
Common pairings
Where Xero integrations earn their keep
The integrations that justify their cost almost always sit at a boundary where orders, bookings or deals become money. System integration work most often connects Xero to a Shopify store, a booking or scheduling system, a client portal, or a CRM such as HubSpot, because those are the points where a transaction is created once in the source system and needs to land in the accounts without anyone retyping it.
Shopify to Xero sync is a common starting point: each completed order becomes an invoice, each refund becomes a credit note, and payment gateway fees get coded to the right account so the bank reconciliation matches on the first pass. National Digital built the Gratofy marketplace, a custom marketplace development project running a Laravel API behind a Nuxt front end, and the same problem of posting orders and payments cleanly through to an accounting system is what most Shopify-Xero integrations are solving for.
Booking systems and client portals follow the same logic in reverse: a paid booking or a portal payment needs to post to Xero as an invoice and payment pair, matched against the bank feed automatically where the gateway and currency line up. A CRM usually only needs one-way sync: a CRM to accounting system sync posts an invoice when a deal is won, with reconciliation limited to confirming the invoice total matches the quote. MYOB's AccountRight API covers the same ground as Xero's, with narrower scopes and an older authentication model, so a MYOB integration is usually a smaller, more constrained build of the same pattern.
Xero and MYOB integration questions
How do I integrate Xero with our existing software?
Register an app with Xero's developer platform, implement OAuth 2.0 so users can grant access, then build the logic that maps your records to Xero's contacts, invoices and payments and posts them through the Xero API. Most businesses connect through a tested integration platform or a custom connector that handles the OAuth and mapping logic for them, so raw API calls are rarely written by hand.
What are Xero's API rate limits?
Xero enforces limits per minute and per day for each connected organisation, and returns a 429 response when a connector exceeds them. A well-built integration queues and retries calls to stay under the limit during traffic spikes. That's why high-volume connectors usually run through middleware that manages the queue centrally.
How does a Shopify to Xero sync actually work?
Each completed Shopify order becomes a Xero invoice, each refund becomes a credit note, and payment gateway fees are coded to the right account so the transaction matches the bank feed. The integration needs to handle partial refunds, multiple currencies and gateway payouts covering several orders at once, which is where most Shopify-Xero projects spend their build time.
Is a MYOB integration different from a Xero integration?
The problem is the same: authenticate, map records, post and reconcile. MYOB's AccountRight API covers similar ground to Xero's but with a different authentication model and narrower endpoint scopes, so a MYOB build is usually a smaller, more constrained version of the same integration pattern.
Should we build a custom Xero integration or use an off-the-shelf connector?
An off-the-shelf connector, Shopify's own Xero app for example, covers standard order-to-invoice sync well and is the right starting point for a single, simple data flow. A custom integration earns its cost once you need specific mapping rules, multiple source systems feeding Xero at once, or an exception queue tailored to how your finance team actually works.
References
- Australian Taxation Office. (2026). Overview of record-keeping rules for business. https://www.ato.gov.au/businesses-and-organisations/preparing-lodging-and-paying/record-keeping-for-business/overview-of-record-keeping-rules-for-business
