# Getting started

Swap the base URL and the credential. Nothing else in your integration moves.

## What changes

```diff
- https://api.xero.com/api.xro/2.0/Invoices
+ https://xero-proxy.fullstackplus.com.au/api.xro/2.0/Invoices

- Authorization: Bearer <xero oauth token>
+ Authorization: Bearer xpk_live_<keyid>_<secret>
```

Query strings, request and response bodies, `Accept` (including XML and PDF), `If-Modified-Since`, pagination and filters all pass through untouched. `Idempotency-Key` is forwarded too, and an account can additionally have the proxy honour it: see [idempotent writes](/developers/idempotency).

## Your first request

```bash
curl -s https://xero-proxy.fullstackplus.com.au/api.xro/2.0/Invoices \
  -H "Authorization: Bearer xpk_live_<keyid>_<secret>" \
  -H "Xero-Tenant-Id: <tenant id>" \
  -H "Accept: application/json"
```

If the key is scoped to exactly one organisation you can drop the `Xero-Tenant-Id` header and it will be filled in for you.

## Discovering which organisations a key can reach

```bash
curl -s https://xero-proxy.fullstackplus.com.au/connections \
  -H "Authorization: Bearer xpk_live_<keyid>_<secret>"
```

The response is in Xero's own `/connections` shape, filtered to the tenants this key may reach, so client libraries that call it on startup work unmodified.

## Before you go live

1. Connect the Xero organisation once, from the dashboard.
2. Mint one key per downstream application, not one shared key.
3. Grant each key only the scopes that application actually calls.
4. Add a network allowlist to any key that calls from fixed addresses.
5. Set an expiry on keys issued to third parties, and rotate on a schedule.