CRM / Finance
Xero OAuth
After authorization, retrieve the Xero tenant list and retain the selected tenant ID with the token record.
Returned from provider
Callback summary
Review returned callback values before exchanging.
- Authorization code
- Present
- Returned state
- Present
- Provider error
- —
- Error description
- —
- Error URI
- —
- 01PrepareEnter provider credentials, scopes, callback details, and PKCE values if required.
- 02AuthorizeBuild the authorization URL and open provider consent.
- 03ExchangePaste the returned code and state, then exchange them for tokens.
- 04VerifyTest the access token against the provider verification endpoint.
- 05Next stepsCopy tokens or metadata, then store them safely outside anonymous mode.
What this workflow can do
- Build authorization URL
- Exchange authorization code
- Refresh token
- Verify access token
Before starting
- Client ID
- Client secret
- Redirect URI
- Scopes
- PKCE only if your app requires it
- Callback code and state
Result handling
- Access token returns from exchange and can be verified in the result panel.
- Refresh token may return from exchange or refresh.
- Callback state is only used to validate the current handshake.
- Anonymous OAuth Hub workflows do not store client secrets, authorization codes, access tokens, or refresh tokens.
Troubleshooting
- Uncertified apps using Authorization Code or PKCE can connect to at most 25 tenants.
- Native clients must use PKCE; Custom Connections use a paid client-credentials flow for one organisation.