Xero

This connector reads the Xero Accounting API for one organisation. All ten tools use GET; no tool creates, updates or deletes accounting data.

Setup

1. At https://developer.xero.com/app/manage create an OAuth2 Web app using the authorisation code flow. Register https://cloud.anythingmcp.com/api/mcp-oauth/callback for AnythingMCP Cloud, or <your AnythingMCP server URL>/api/mcp-oauth/callback for a self-hosted server. The redirect URI must match exactly. Copy the Client ID and Client Secret into XERO_CLIENT_ID and XERO_CLIENT_SECRET.
2. Leave XERO_TENANT_ID and XERO_REFRESH_TOKEN empty, install, then open the connector and click Authorize with Provider. Sign in to Xero and connect the intended organisation. AnythingMCP exchanges the code at Xero Identity using HTTP Basic client authentication and stores the tokens.
3. Run xero_list_connections with {}. Choose the entry with the intended tenantName and tenantType: ORGANISATION, and copy its tenantId into XERO_TENANT_ID. The connection's id and authEventId are different values and must not be used. See https://developer.xero.com/documentation/guides/oauth2/tenants/. Until XERO_TENANT_ID is set, the other tools stop before calling Xero and name the missing variable.
4. Run xero_get_organisation with {} and check the returned organisation name before reading its accounts or transactions. Install a separate connector for each organisation.

If you prefer to know the tenant ID before installing, read it with Postman instead: also register https://oauth.pstmn.io/v1/browser-callback on the Xero app. In Postman Desktop create a GET request to https://api.xero.com/connections. On its Authorization tab select OAuth 2.0, grant type Authorization Code and Authorize using browser. Set that Postman callback URL, Auth URL https://login.xero.com/identity/connect/authorize, Access Token URL https://identity.xero.com/connect/token, your app's Client ID and Client Secret, the read-only scope string below, a random State, and Client Authentication Send as Basic Auth header. Select Get New Access Token, sign in, choose the intended organisation and select Use Token. Keep Share Token off. Then send the GET Connections request and copy the tenantId as in step 3. See https://learning.postman.com/docs/use/send-requests/authorization/oauth-20/ and Xero's walkthrough at https://github.com/XeroAPI/xero-postman-oauth2; use this connector's current read-only scopes rather than the walkthrough's older scope examples. Stop using the Postman tokens once AnythingMCP is authorised; it maintains its own.

Read-only scopes openid offline_access accounting.invoices.read accounting.contacts.read accounting.settings.read accounting.reports.trialbalance.read accounting.reports.profitandloss.read. These are the current granular scopes; deprecated accounting.transactions.read and accounting.reports.read are not requested. Identity scopes are limited to openid and offline_access. Xero consent is additive: a token previously granted write permissions keeps them. To reduce permissions, revoke the old connection in Xero and authorise again with these scopes. See https://developer.xero.com/documentation/guides/oauth2/scopes/.

Tokens and tenant header Every Accounting call includes xero-tenant-id: XERO_TENANT_ID and a bearer access token; xero_list_connections sends only the bearer token. Access tokens last 30 minutes; offline_access supplies refresh tokens, which expire after 60 days without renewal. AnythingMCP refreshes automatically and saves replacement refresh tokens. You may supply XERO_REFRESH_TOKEN only if you already obtained a current token for the same app and read-only consent. Do not share a rotating refresh token between integrations. Changing the tenant ID changes the organisation every tool reads.

Lists and identifiers Invoices include sales invoices (ACCREC) and purchase bills (ACCPAY). Invoices and contacts use 1-based page and pageSize, defaulting to page 1 with 100 records. Request subsequent pages until the nested Invoices or Contacts array is empty or shorter than pageSize. Accounts returns the chart of accounts without pagination. where uses Xero filter syntax, for example Type=="ACCREC" or ContactStatus=="ACTIVE"; order accepts values such as InvoiceNumber ASC and Name ASC. Get tools require the UUID returned by the corresponding list, not an invoice number, contact name or account code. List and detail responses retain Xero's Invoices, Contacts, Accounts and Organisations envelopes.

Reports Pass YYYY-MM-DD dates: Trial Balance uses date; Profit and Loss uses fromDate and toDate with fromDate no later than toDate. paymentsOnly defaults to false for accrual reports; set true for cash reports. Profit and Loss can compare 1 to 12 periods using periods and timeframe (MONTH, QUARTER or YEAR). Reports retain the Reports envelope and nested Rows/Cells; financial values may be strings. The authorising Xero user needs access to reports.

Errors and limits For 401 or 403 check consent, token expiry, Xero user permissions and whether the tenant is connected to this app. On HTTP 429, pause requests to that tenant for the Retry-After seconds; inspect X-Rate-Limit-Problem and retry with backoff instead of immediately paging again. Limits depend on the app tier: https://developer.xero.com/documentation/guides/oauth2/limits/.

Cloud and self-hosted Both use Xero's public HTTPS Accounting and Identity endpoints with the same scopes and tenant header; only the registered callback differs. Live Xero authorisation and API calls have not been verified for this adapter.