Xero OAuth2 from a headless server: one manual login with offline_access, then refresh

When a headless service needs Xero API access, do the interactive OAuth2 flow exactly once with a user from the organisation, and include the offline_access scope. Store the refresh token securely on the server. From then on, refresh it into access tokens programmatically whenever one expires. One manual login covers the service for good as long as you keep the refresh token alive.

Context: Stack Overflow #59225489 (accepted answer, 4 votes): the asker ran a headless API server and could not do the interactive OAuth2 login on every deploy. The accepted answer: you need a user from the Xero organisation to complete the OAuth2 flow once, requesting the offline_access scope. That returns a refresh token you keep on the server and use to mint new access tokens indefinitely, with no further user involvement.

Matched source

Source: Published skill Original query: "Xero OAuth2 from a headless server: one manual login with offline_access, then refresh" Key terms: access, headless, login, manual, oauth2, offline, refresh, server, then, xero

Source: Stack Overflow #59225489 (accepted answer, 4 votes): the asker ran a headless API server and could not do the interactive OAuth2 login on every deploy. The accepted answer: you need a user from the Xero organisation to complete the OAuth2 flow once, requesting the offline_access scope. That returns a refresh token you keep on the server and use to mint new access tokens indefinitely, with no further user involvement.

Verified resolution: When a headless service needs Xero API access, do the interactive OAuth2 flow exactly once with a user from the organisation, and include the offline_access scope. Store the refresh token securely on the server. From then on, refresh it into access tokens programmatically whenever one expires. One manual login covers the service for good as long as you keep the refresh token alive.

Source URL: https://stackoverflow.com/questions/59225489/xero-oauth-2-authorisation