0

Our aim to facilitate machine-to-machine communciation between our backend services and Xero API for a large number of Xero organisations (1000+).

One model which has been proposed is:

  1. Build a custom Web App in developer portal
  2. Advise each client to go to the web app, Authorize the Web App for their Xero organisation and log in
  3. Retrieve the refresh_token and access_token (with offline_access)
  4. Securely persist the refresh_token in our backend secrets store
  5. When M2M API access is required, use the refresh_token to update the access_token and use access_token to talk to the Xero API
  6. If refresh token not utilized for say 55 days, then automatically refresh it to keep it alive.

We've heard about developers getting this solution to work but uncomfortable with committing to this approach without some reassurances. Questions:

  1. Is this method of M2M authentication (with initial user intervention) approved by Xero, or will it be disallowed in future?
  2. Given the need to support access to 1000+ organisations, would the Web App need to become certified?
  3. Similarly, would this trigger a security audit? (ie. https://developer.xero.com/partner/security-standard-for-xero-api-consumers )
  4. Would a security audit be limited to the solution we built or other non-Xero-API apps?
  5. Is there any limit to the number of times a refresh_token can be extended/refreshed or can we rely on this to be kept alive indefinitely (assuming our systems auto-refresh before 60 days)?
  6. What are the pros and cons of this approach vs. Custom Connections?

We have tried to communciate with the Xero support team but so far failed to get clear answers to these questions.

Brendan Hill
  • 3,406
  • 4
  • 32
  • 61

1 Answers1

1

The method you outline is perfectly fine.

Refresh tokens are single use, they expire after 60 days or when used, whichever is sooner.

When you refresh the access token you get a new access token and a new refresh token. The new refresh token has a new 60 day lifetime each time and so as long as you refresh before 60 days and the customers do not disconnect, you will have indefinite access.

If you have more than 25 connections you will need to be certified, over 1,000 connections also needs a security assessment.

The API terms and conditions include a clause where you can't create multiple versions of your applications that access the Developer Platform for the same or similar usages (e.g. creating customer-specific versions of Your Applications) and so custom connections would contravene this clause

sallyhornet
  • 364
  • 2