Xero signs users in with their Xero account, the identity behind small-business accounting integrations.

## Copy the redirect URI

In the [Authdog console](https://console.authdog.com), select the project and environment, open **Authentication > Providers**, find **Xero**, and click **Enable**. Copy the redirect URI shown in the form:

```url
https://identity.authdog.com/api/v1/callback/<connectionId>
```

## Create the application

1. Open the [Xero Developer portal](https://developer.xero.com/app/manage) and select **New app**.
2. Choose **Web app**, name it, and provide the company URL.
3. Under **Redirect URI**, paste the redirect URI from Authdog.
4. Create the app, then generate a client secret under **Configuration**.
5. Copy the **Client ID** and the generated **Client Secret**.

## Configure Authdog

| Field | Value |
| --- | --- |
| **Client ID** | The client identifier from the provider |
| **Client Secret** | The client secret from the provider |

Save, then toggle the connection **active**.

## What Xero returns

Authdog requests the `openid profile email` scopes and reads the profile from `https://api.xero.com/identity/connect/userinfo`.

The identity userinfo endpoint returns the `xero_userid`, email, and name of the signed-in user.

Xero separates identity from tenants: a user may authorize several organizations. Sign-in tells you who the person is, not which organization they are acting for.

## Test it

1. Open your environment's hosted sign-in page, or link to `https://identity.authdog.com/api/v1/signin/<connectionId>`.
2. Select the Xero button and complete the flow.
3. Confirm the user appears under **Users** in the console with a Xero identity linked.

## Troubleshooting

| Symptom | Cause |
| --- | --- |
| `unauthorized_client` | The app type is not a web app, so it has no client secret |
| `invalid_grant` | The client secret expired — Xero secrets have a fixed lifetime |
| Redirect or callback URL error | The URI registered with the provider does not match Authdog's exactly |
| Works in one environment only | Each environment has its own `connectionId`, and so its own redirect URI to register |

## Related

| Read | To learn how to |
| --- | --- |
| [Connectors](/docs/connectors) | Set up any other social provider |