XO Report connects to Xero via the official Xero API using OAuth 2.0 authentication. Data flows one way — from Xero into Excel. XO Report does not write, modify, or delete any data in Xero.

How It Works

1. User authorizes XO Report in their Xero organization via standard OAuth consent
2. Access tokens are stored securely in a Supabase PostgreSQL database
3. When a user types a formula or inserts a table, the Excel add-in calls a Supabase Edge Function
4. The Edge Function authenticates with Xero using the stored token and fetches the requested data
5. Data is returned to Excel and displayed in cells or tables
6. Tokens are refreshed automatically — users stay connected without re-authenticating

Xero API Scopes Used

• openid, profile, email — User identity for authentication
• offline_access — Refresh token, so users stay connected
• accounting.transactions.read — Invoices, bills, credit notes, payments, bank transactions
• accounting.contacts.read — Contacts and contact groups
• accounting.settings.read — Chart of Accounts, tracking categories, tax rates, currencies, organization details
• accounting.reports.read — P&L, Balance Sheet, Trial Balance, Bank Summary, Executive Summary, aged reports
• accounting.budgets.read — Budgets for XO.BUDGET and the Budget Summary report

New connections use Xero's granular read-only equivalents of these scopes. All scopes are read-only.

Data Flow Architecture

Excel Add-in → Supabase Edge Functions → Xero API

All API calls are proxied through Supabase Edge Functions. The Excel add-in never communicates directly with Xero. This architecture ensures tokens are never exposed to the client.

Data Handling

• Read-only integration — no data is written back to Xero
• No data is cached permanently — each refresh fetches live data from Xero
• Short-term client-side caching (5–30 minutes) reduces redundant API calls
• Users can disconnect organizations at any time, which revokes the OAuth token

Rate Limiting

XO Report respects Xero's API rate limits with built-in request queuing and exponential backoff. Concurrent requests are limited to prevent throttling.

Security

• OAuth tokens encrypted at rest (AES-256-GCM)
• Row-Level Security (RLS) on all database tables — users can only access their own data
• Requests made for a signed-in user require a verified session token (JWT). Xero sign-in starts publicly and its callback checks an expiring, single-use state value with PKCE; session handoff uses one-time codes; payment and email webhooks verify the provider signature; internal admin, monitoring and scheduled endpoints require secret credentials
• PII scrubbed from error monitoring (Sentry)
• GDPR data erasure endpoint available