I've been over and over the docs and posts and I'm obviously missing something. Can anyone explain or point me to a clear example of how I can connect to the xero api using my client_id and secret and NOT requiring a click to authorise the connection ?

I'm trying to automatically generate invoices and send them to bookings on a public site and I can't see how the redirect and manual authorisation could work in this scenario.

I'm using the xero-php-oauth2 library but all examples seem to require a user to manually authorize access or they assume a token exists as per in the documentation example below. I have found information on creating an invoice and adding lineitems but just can't seem to get my head around how to automate the process of connecting

What am I missing ??

require_once(__DIR__ . '/vendor/autoload.php');

// Configure OAuth2 access token for authorization: OAuth2
$config = XeroAPI\XeroPHP\Configuration::getDefaultConfiguration()->setAccessToken( 'YOUR_ACCESS_TOKEN' );       

$apiInstance = new XeroAPI\XeroPHP\Api\AccountingApi(
    new GuzzleHttp\Client(),
    $config
);``` 
 

I've been over and over the docs and posts and I'm obviously missing something. Can anyone explain or point me to a clear example of how I can connect to the xero api using my client_id and secret and NOT requiring a click to authorise the connection ?

I'm trying to automatically generate invoices and send them to bookings on a public site and I can't see how the redirect and manual authorisation could work in this scenario.

I'm using the xero-php-oauth2 library but all examples seem to require a user to manually authorize access or they assume a token exists as per in the documentation example below. I have found information on creating an invoice and adding lineitems but just can't seem to get my head around how to automate the process of connecting

What am I missing ??

require_once(__DIR__ . '/vendor/autoload.php');

// Configure OAuth2 access token for authorization: OAuth2
$config = XeroAPI\XeroPHP\Configuration::getDefaultConfiguration()->setAccessToken( 'YOUR_ACCESS_TOKEN' );       

$apiInstance = new XeroAPI\XeroPHP\Api\AccountingApi(
    new GuzzleHttp\Client(),
    $config
);``` 
 

• php
• xero-api

• 1 Depends, on what exactly you need to do. For "non-tenanted endpoints", there is the possibility to use Client Credentials. If you need to do stuff that isn't possible using those - then you will need to implement the redirect login flow. Refresh tokens help to implement this in a way where you only need to send the user through the login flow once. – C3roe Commented Feb 7 at 8:14
• developer.xero.com/documentation/guides/oauth2/… – ADyson Commented Feb 7 at 8:16
• 1 When I was trying to implement this (not in PHP, I should add) I found that there was a useful video on the Xero Youtube channel, I can't find the video now but it might be worth a look around there. Something about "machine to machine" connections, as I was developing a Windows Service to sit in the background and do the interaction for me. – droopsnoot Commented Feb 7 at 8:50

1 Answer 1

If you want a connection flow akin to machine-to-machine where there is no human intervention required to authorize the connection every time, I suggest looking into the PKCE flow.

You will authorize your app once (step 1) and then retain the access token, refresh token and access token expiry time. Store those somewhere that can be accessed upon your invoice generation automation running (I personally use a very simple DynamoDB instance) to determine if the current access token is valid or if it's expired. If the current access token is expired then use the refresh token to get a new access token.

You can then use the access token in the Authorization header for all API requests for that session.