Xero integration reconciliation
Keep each Xero request tied to the intended organisation
Concurrent jobs must not share mutable tenant context. Resolve and pass the connection explicitly so one organisation's work cannot be sent under another's identity.
In this article
Treat connection selection as an access decision
A user or job selecting an organisation must be authorised for the application's corresponding connection. A supplied tenant identifier is not proof of that authority.
Resolve the trusted mapping before queueing work and preserve it in the operation record. The worker should not use whichever connection happens to be active in a shared client.
Handle revoked or disconnected access as a visible state requiring the appropriate recovery, not an invitation to fall back to another organisation.
Review token storage and refresh
Protect tokens through the chosen secret and persistence mechanisms. Limit which services can retrieve or refresh them and avoid logging token values.
Concurrent refresh behaviour should follow the supported client and provider model. Shared mutable token state can cause requests to use an unexpected identity if the implementation is not scoped correctly.
Keep connection metadata and operation data associated through trusted application records.
Test two organisations together
Use safe test connections and similar synthetic document details in each. Run requests concurrently and verify the resulting resources are created or read only in the intended organisation.
Include background retries, a disconnected connection and a user who loses application access before queued work executes. Apply the documented authority policy for that job.
Inspect actual provider results and local mappings, not only request logs.
Restrict reconciliation access
Support staff may need to inspect document state and operation history. Give them the scope needed for their role without exposing all organisations or tokens.
Keep financial payloads out of broad monitoring and error messages. Use identifiers and bounded failure reasons with a controlled path to detail.
The review should prove that organisation identity survives the full workflow, including concurrency and recovery. Correct field mapping is of little value if the request reaches the wrong business account.
Primary sources
Xero: managing tokens and identifiersReferences checked 11 September 2026.