# Xero Proxy

> A multi-tenant Xero API gateway. One OAuth connection to a Xero organisation, fanned out to unlimited downstream applications through scoped, revocable API keys. The proxy is a one-to-one passthrough: only the base URL and the credential change.

## Documentation

- [Overview](https://xero-proxy.fullstackplus.com.au/developers/overview.md): What the proxy does, what it deliberately does not do, and how a request travels through it.
- [Getting started](https://xero-proxy.fullstackplus.com.au/developers/getting-started.md): Swap the base URL and the credential. Nothing else in your integration moves.
- [Authentication and keys](https://xero-proxy.fullstackplus.com.au/developers/authentication.md): Key format, the Xero-Tenant-Id rule, rotation with a grace window, and instant revocation.
- [Scopes](https://xero-proxy.fullstackplus.com.au/developers/scopes.md): Xero's own scope strings, used unchanged, and how a key's grant is narrowed by the connection.
- [Route reference](https://xero-proxy.fullstackplus.com.au/developers/routes.md): Every mapped endpoint and the scope it requires, generated from the enforcement table.
- [Errors](https://xero-proxy.fullstackplus.com.au/developers/errors.md): How to tell our refusal from Xero's, and what every proxy error code means.
- [Rate limits and quota](https://xero-proxy.fullstackplus.com.au/developers/rate-limits.md): What Xero limits, what we forward untouched, and how an account divides one shared budget between several applications.
- [MCP servers](https://xero-proxy.fullstackplus.com.au/developers/mcp.md): Two Model Context Protocol endpoints: a management control plane, and a public documentation server.
- [Machine-readable docs](https://xero-proxy.fullstackplus.com.au/developers/machine-readable.md): OpenAPI, markdown variants and llms.txt, for tooling and for language models.
- [Alerting](https://xero-proxy.fullstackplus.com.au/developers/alerts.md): The built-in rules, how they are evaluated, and where notifications go.
- [Read caching](https://xero-proxy.fullstackplus.com.au/developers/caching.md): How repeat reads are served without spending Xero quota, what invalidates them, and how to opt out per request.
- [Diagnosing a request](https://xero-proxy.fullstackplus.com.au/developers/diagnostics.md): Every response carries an id. What it is for, and how to get from a failure to the reason for it.
- [Idempotent writes](https://xero-proxy.fullstackplus.com.au/developers/idempotency.md): How to retry a write that timed out without creating it twice, and what the proxy does with an Idempotency-Key.
- [Deferred execution](https://xero-proxy.fullstackplus.com.au/developers/deferred.md): Ask to be queued instead of refused: how a 429 becomes a 202 with a handle, and how to collect the answer.
- [Completion callbacks](https://xero-proxy.fullstackplus.com.au/developers/callbacks.md): Be told when deferred work finishes, instead of polling for it: registering an endpoint, verifying the signature, and what a callback deliberately does not contain.
- [Event webhooks](https://xero-proxy.fullstackplus.com.au/developers/webhooks.md): Xero events fanned out to as many of your own endpoints as you like, signed, retried and deduplicated.

## Machine-readable

- [OpenAPI](https://xero-proxy.fullstackplus.com.au/openapi.json): every mapped route and its required scope.
- [Full documentation](https://xero-proxy.fullstackplus.com.au/llms-full.txt): the whole set as one file.
- [Documentation MCP server](https://xero-proxy.fullstackplus.com.au/api/mcp/docs): search and read the docs over MCP.