Xero PHP OAuth2 SDK

Xero PHP OAuth2 is the official, Xero-maintained SDK that lets PHP applications talk to Xero’s cloud accounting platform. Generated from Xero’s OpenAPI 3 specification, it exposes strongly typed models and API classes covering accounting, payroll, assets, files, projects, finance, and the app store, so you work with PHP objects instead of hand-built HTTP requests and JSON.

The SDK bundles the full OAuth2 authorization-code flow on top of the League OAuth2 client, handling token exchange, refresh, and JWT decoding for you. Once authenticated, a single configured client gives typed access to hundreds of endpoints, with request/response serialization, error handling, and pagination taken care of by the generated layer.

What You Get

• Complete coverage of Xero’s Accounting, Payroll (AU/NZ/UK), Assets, Files, Projects, and Finance APIs
• A built-in OAuth2 authorization-code flow via league/oauth2-client
• JWT decoding and token refresh handling out of the box
• Strongly typed request and response models generated from the OpenAPI spec
• A configurable client using Guzzle for transport
• Extensive generated docs describing every model and endpoint

Common Use Cases

• Syncing invoices, bills, and contacts between an app and Xero
• Building integrations that read accounting reports and balances
• Automating payroll data submission for AU, NZ, or UK organizations
• Managing Xero app-store subscriptions and connections programmatically

Under The Hood

Architecture - The SDK follows the standard OpenAPI-generator PHP layout under lib/. Per-domain API classes (AccountingApi, PayrollAuApi, FilesApi, ProjectApi, FinanceApi, IdentityApi, and more) accept a Guzzle client and a Configuration object, build requests, and deserialize responses into typed model objects via domain-specific ObjectSerializer classes. Authentication is layered separately through league/oauth2-client, so token acquisition and refresh are decoupled from the API call layer.

Tech Stack - Pure PHP targeting 8.1+, autoloaded via PSR-4 under XeroAPI\XeroPHP. Runtime dependencies are guzzlehttp/guzzle for HTTP transport, league/oauth2-client for the OAuth2 flow, and firebase/php-jwt for identity-token decoding, plus the curl, json, and mbstring extensions. Development uses php_codesniffer and php-cs-fixer for style enforcement.

Code Quality - As generated code, the models and API classes are highly consistent and repetitive by design, with uniform serialization and error handling across every endpoint. It relies on the correctness of Xero’s OpenAPI spec and the generator rather than a large hand-written test suite, so the emphasis is on breadth and fidelity to the API contract over bespoke logic.

API Design - Ergonomics follow the generated-SDK convention: instantiate an API class with a configured client and access token, then call a method per endpoint that returns typed models. This is predictable and well documented (the docs/ directory covers every model and operation), though callers must still wire up the OAuth2 handshake and pass a valid tenant/token on each call.