Your Xero password stays with Xero
When you connect, you're taken to Xero's own login page — we never see your credentials. You choose exactly what we can access, and you can disconnect us at any time from inside your Xero settings. Your connection is encrypted and refreshes automatically in the background.
- Auth flow
- Authorization Code + PKCE
- Token storage
- Encrypted at rest
- Refresh
- Auto-refreshed every hour
- Scopes used
- accounting.transactions, accounting.transactions.read, accounting.settings, offline_access

