Skip to content

Xero Connect

Most stores still move sales into their accounts by hand — re-keying every Magento order into Xero, or paying for middleware that breaks on each upgrade. Xero Connect pushes a Magento order to Xero as a proper sales invoice in one click: it connects over OAuth 2.0 with your own Xero app (so there’s nothing to certify and no per-order fee), matches or creates the customer, and records the Xero invoice ID against the order so the same sale is never sent twice.

Xero Connect configuration — Xero App Credentials (OAuth Client ID/Secret and the Connect button) and the Invoice Sync settings

Install Xero Connect with Composer using your AgenticEcom licence key (find it on your My Licences page — one key unlocks every module you own):

Terminal window
# 1. Register the AgenticEcom repository (once per store)
composer config repositories.agenticecom composer https://repo.agenticecom.net
composer config --global --auth http-basic.repo.agenticecom.net <YOUR-LICENCE-KEY> x
# 2. Require this module
composer require agenticecom/module-xero-connect
# 3. Apply it
php bin/magento setup:upgrade && php bin/magento setup:di:compile && php bin/magento cache:flush

Magento

Open Source 2.4.9 GA (and later 2.4.x).

PHP

Tested on 8.4 and 8.5.

Connection

OAuth 2.0 to Xero — your own app, no certification.

Cost to run

No middleware subscription, no per-order charge.

One-click invoice

Open any order and click Push to Xero — a sales invoice is created in your Xero organisation with the line items, customer and totals from the order.

Single, bulk or automatic

Push one order from its detail page, select many in the Orders grid and push in bulk, or turn on Auto-Push to send each order the moment its Magento invoice is created.

Never duplicates

Each order is pushed idempotently — once it syncs, its Xero invoice ID is stored on the order, so re-running a bulk action can’t create a second invoice.

Customers handled

Buyers are matched to a Xero contact by email, or created automatically if they’re new — your contact list stays clean without manual tidying.

  1. At developer.xero.com, create an OAuth 2.0 app for your organisation. (It’s free — there’s no certification or app-store listing to wait on.)

  2. In Magento, go to Stores → Configuration → AgenticEcom → Xero Connect. Copy the Redirect URI shown there and paste it into your Xero app’s Redirect URIs list, then save the Xero app.

  3. Back in Magento, paste your Xero app’s Client ID and Client Secret into the configuration and Save.

  4. Click Connect to Xero, authorise your organisation in the popup, then close it. Magento stores the returned tokens encrypted.

  5. Set the Invoice Sync options — invoice status, the sales and shipping account codes to map to, and (optionally) Auto-Push New Orders.

Open the order in Sales → Orders and click Push to Xero. The order’s Xero invoice ID is recorded on it once the invoice is created.

Do I need a paid Xero app or certification?

No. You create a standard OAuth 2.0 app in your own free Xero developer account in a few minutes. There’s no certification process and no app-store listing — Magento connects directly to your own Xero organisation, which is why there are no per-order fees.

Will it ever create duplicate invoices?

No. Each order is pushed idempotently: once an order syncs, its Xero invoice ID is stored against the order, so re-running a bulk push or re-saving the order will never create a second invoice.

How are customers handled in Xero?

Buyers are matched to an existing Xero contact by email address. If no contact exists, one is created automatically, so your Xero contact list stays in step with your store.

How is tax handled?

Line amounts are sent to Xero tax-exclusive, and Xero applies the tax rate configured on the sales account you map. That keeps VAT consistent with your Xero chart of accounts.

Are my Xero credentials stored safely?

Yes — your Client Secret and the OAuth access and refresh tokens are stored with Magento’s encrypted configuration backend and decrypted only when a sync runs. The authorisation flow is CSRF-protected with a one-time state value. Verified clean on PHP 8.4 and 8.5.