Getting started

- https://api.xero.com/api.xro/2.0/Invoices
+ https://xero-proxy.fullstackplus.com.au/api.xro/2.0/Invoices

- Authorization: Bearer <xero oauth token>
+ Authorization: Bearer xpk_live_<keyid>_<secret>

Query strings, request and response bodies, Accept (including XML and PDF), If-Modified-Since, pagination and filters all pass through untouched. Idempotency-Key is forwarded too, and an account can additionally have the proxy honour it: see [idempotent writes](/developers/idempotency).

curl -s https://xero-proxy.fullstackplus.com.au/api.xro/2.0/Invoices \
  -H "Authorization: Bearer xpk_live_<keyid>_<secret>" \
  -H "Xero-Tenant-Id: <tenant id>" \
  -H "Accept: application/json"

If the key is scoped to exactly one organisation you can drop the Xero-Tenant-Id header and it will be filled in for you.

curl -s https://xero-proxy.fullstackplus.com.au/connections \
  -H "Authorization: Bearer xpk_live_<keyid>_<secret>"

The response is in Xero's own /connections shape, filtered to the tenants this key may reach, so client libraries that call it on startup work unmodified.

1. 1.Connect the Xero organisation once, from the dashboard.
2. 2.Mint one key per downstream application, not one shared key.
3. 3.Grant each key only the scopes that application actually calls.
4. 4.Add a network allowlist to any key that calls from fixed addresses.
5. 5.Set an expiry on keys issued to third parties, and rotate on a schedule.