Bank and books
Connect Xero to Sondola
What Sondola reads from Xero: revenue, net burn, cash and spend by category. Read-only, with the source and period beside every number.
Read-only. Sondola never changes your data in Xero.
- Credential
- OAuth 2.0 through your own app
- Refresh
- Twice a day
- How it connects
- Collected automatically
- Setup time
- About 10 minutes
What Sondola reads from Xero
- Revenue
- Net burn, books
- Cash
- Spend by category
What you need
- You need a Xero login with access to the organisation you want to read. The app is registered in YOUR Xero developer account, so the credential only ever reaches your own organisation. Sondola never holds a key to your books. There is no review and no waiting.
Collection timing and the period a reading covers are separate. Check the source's data-through date as well as the metric's reporting period.
Connect Xero in 6 steps
- Register an app
developer.xero.com, My Apps, New app. Integration type Web app. App name can be anything, for example Metrics. Company URL can be your own website.
My Apps ↗ - Set the redirect URI
Add exactly https://jyehacfzezdjkvearxbi.supabase.co/functions/v1/oauth/callback with no trailing slash. Xero compares it character for character.
- Copy the Client ID and generate a secret
The Configuration tab shows the Client ID. Press Generate a secret, copy it immediately, and paste both into the fields here.
The secret is shown once. - Press Connect to Xero and approve
Approve the organisation you want read. Sondola asks for four scopes and no more: accounting.reports.profitandloss.read for revenue and operating costs, accounting.reports.banksummary.read for the cash in your bank accounts, accounting.settings.read for the organisation's name and currency, and offline_access, which lets the connection keep working without asking you again.
Profit and loss scope: accounting.reports.profitandloss.read. Bank summary scope: accounting.reports.banksummary.read. Settings scope: accounting.settings.read. Offline scope: offline_access.Without offline_access Xero issues no refresh token, and the connection stops working after 30 minutes. Apps created since March 2026 only get scopes asked for by name, which is why the list is spelled out. - Pick the organisation, if you have more than one
If the login reaches several Xero organisations, the Organisation setting lists them after Save and test. Choose the one these numbers should come from. Nothing is read until you do.
- You do not need to be a Xero App Partner
An uncertified Xero app may hold 25 active connections. This app is yours and uses one of them. Certification, the App Store listing and the referral share all apply to somebody publishing an app for other people, which is not what this is.
Enter credentials only in your Sondola workspace. Keep keys out of screenshots, public repositories and support messages.
What Sondola asks you for
developer.xero.com, My Apps, your app, the Configuration tab.
Same Configuration tab. Press Generate a secret.
Xero shows the secret once and never again. If you did not copy it, generate another one. That is harmless and does not break anything already connected.You never paste this. It arrives when you press Connect to Xero and approve.
Xero expires a refresh token after 60 days WITHOUT USE, and rotates it on every refresh so the previous one stops working immediately. Sondola reads on a schedule, which keeps it alive. If collection is paused for two months the connection dies and you reauthorize once.Arrives with the consent. If your login can see more than one Xero organisation, you pick which one here after connecting.
One Xero login often reaches several organisations. The numbers change completely depending on which one is selected, so check this before trusting a figure.Secrets are stored encrypted in your workspace, in a vault kept separate from the application database. Sondola never shows them again.
Permissions
- Four scopes and no more: accounting.reports.profitandloss.read, accounting.reports.banksummary.read, accounting.settings.read and offline_access.
- The app is registered in your own Xero developer account, so the credential only reaches your own organisation.
Refresh and first reading
Twice a day. Most tools refresh once or twice a day, and every number shows when it was read.
Save and test exchanges the refresh token, lists the organisations the consent covers, then reads one profit and loss from the organisation you picked, so a green result means the books are readable and not only that the token is valid.
Troubleshooting
Save and test rejects the credential.
Xero shows the secret once and never again. If you did not copy it, generate another one. That is harmless and does not break anything already connected. Xero expires a refresh token after 60 days WITHOUT USE, and rotates it on every refresh so the previous one stops working immediately. Sondola reads on a schedule, which keeps it alive. If collection is paused for two months the connection dies and you reauthorize once.
The test passes but no reading appears.
The collector runs on its schedule, so a successful test does not mean a reading has landed. Check the source's data-through date and the metric's reporting period, and treat a missing reading as missing, not zero.
A number differs from Xero.
Compare the definition, unit and reporting period with the same number in Xero before treating a difference as an error. When a stored reading changes, its history keeps the old value, the new value and the reason.
Provider documentation
Readings missing or old? Read the setup and troubleshooting guide and the worked freshness example.
Related integrations
See your company clearly by Monday.
Apply in two minutes. Once you are in, your first numbers arrive minutes after you connect a tool.
Free for qualifying startups. Read-only.