Xero expands developer tools with new webhook events

Xero has expanded its developer platform with new webhook events for credit notes and a revised API pricing model for app partners.

The changes are part of a broader update to the accounting software group's developer ecosystem, including new permission scopes, annual recertification for certified apps, and early testing of a command-line tool.

Pricing shift

Xero's new API pricing model took effect for new apps on 2 March. Apps created from that date move straight onto a free starter tier, with upgrades available through the developer portal when connection or rate limits are reached.

Existing apps will not move at the same time. Partners will receive 30 days' notice before their migration date, along with details on metering and invoicing under the new terms.

Regan Ashworth, Head of Ecosystem Governance at Xero, said, "The important things to note are you will have 30 days' notice from when we send the email, and then that email will have your migration date in it."

Xero is also urging developers to review their data egress levels and billing details in the developer portal. Some partners may also need to meet additional compliance requirements, particularly for premium access to the journals endpoint or the Xero Practise Manager API.

The developer portal now includes connection management tools. Developers can remove connections manually there, while larger-scale changes can still be handled through the API.

Webhook rollout

The most significant product release in the update was the general availability of credit notes webhook events. The feature responds to heavy polling activity from developers by letting app partners receive notifications when records change, rather than sending repeated requests.

Parikshit Ghosh, Senior Product Manager at Xero, said, "The credit notes and events are now available for you to be able to consume."

Credit notes had been one of the most heavily polled areas of Xero's API estate, generating about 16 million GET calls each month across 4,000 apps in the ecosystem.

Since launch, around 150 apps have subscribed to the new event stream, according to Ghosh. Some partners have seen almost a 50% reduction in GET calls after switching from polling to notifications.

The webhook release runs on a rebuilt event architecture rather than the legacy platform used for earlier webhook products. Ghosh said invoices and contacts remain on the older system for now, although Xero is working on patterns that would allow richer metadata in those event payloads as well.

Granular scopes

Xero has also broken up some of its broadest API permission scopes. The accounting transactions scope now has smaller replacements for specific data sets, including invoices, bank transactions, and manual journals. The accounting reports scope has been split, so each report now has its own scope.

The change is already live for new apps. Existing apps will receive the granular scopes in April, with the older, broader scopes to be phased out later.

Ashworth said the update reflects requests from developers for tighter control over the access an app asks of users. It also gives end users a clearer view of the data an app is requesting.

Recertification

Xero has started its second annual recertification exercise for certified integrations and apps listed in the Xero App Store. The process checks business details, contact information, and continued compliance with certification requirements.

Developers who do not complete the assessment risk temporary removal from the App Store. Under the current pricing structure, apps on the Plus plan or above must go through the process each year.

Xero also clarified that an App Store listing is not mandatory for every app. Unlisted profiles remain possible, including for apps built for restricted groups such as franchise networks. Public listing is required only from the enterprise tier, while it remains optional for Plus and Advanced tiers.

Custom connections

Xero said it has seen increased use of custom connections. These are a premium integration type and require a separate subscription for the lifetime of the connection.

Breana McHugh, Senior API Technical Specialist at Xero, said developers trying to use custom connections with Xero's MCP server may hit issues. Those users can still connect through a web or PKCE app, then pass the access token into the MCP server.

Xero also outlined an alternative route for machine-to-machine integrations outside custom connection regions. In those cases, developers can use the standard code flow with offline access and refresh tokens, though the initial connection still requires a web-based authentication step.

AI tools

Xero used part of the update to outline its view that AI coding tools are widening access to software development. Ashworth said experienced engineers retain an advantage, but newer tools have lowered the barrier for non-technical founders, designers, and product managers to build working software.

"I like the term builder, I think it's more inclusive. I think developer, some people still think of a developer as somebody that writes code, but,  I would say a developer is a thing, you know, like. engineer is probably a better term for those people that have a software development background," said Ashworth.

Xero recently released an MCP server and agentic software development kits built around LangChain, Google Agent Development Kit, and OpenAI's Agents SDK. It has also launched a command-line interface tool in developer preview and is looking for alpha testers.

Xero linked that work to growing interest in agent-based software and command-line workflows. The CLI tool remains at an early stage and is being tested with developers.

Xero also stressed that any rise in AI-built software will not alter its standards for listed apps. Ashworth said the App Store will continue to operate with a quality threshold for security, reliability, and product standards.

"There is a quality bar that needs to be met," said Ashworth.