Xero

Where to apply: Register at developer.xero.com and create the app under My Apps; credentials are issued on the spot. Certification is now requested from inside the developer portal rather than by a separate partner application: get onto the Core plan, then log into the Xero Developer Centre, select your app and click 'Manage Plan' to upgrade to Plus - certification is applied for as part of that upgrade. Work through developer.xero.com/documentation/xero-app-store/app-partner-guides/certification-checkpoints first, and expect to provision a test account for the reviewer; a Xero developer evangelist runs the review. Two categories need prior approval before you can even apply: apps using the Practice APIs including Xero Practice Manager (email api@xero.com) and financial-services apps such as banking, payments, lending and insurance (Section 11 form). Custom Connections are created in the same My Apps screen by choosing 'Custom connection' as the integration type.

• The review step checks you already have ten active customer connections (and Sign Up with Xero built), so you cannot certify before you have real users - and the free tier only allows 5 connections, so you must be paying for the Core tier to reach ten.
• Sign Up with Xero (and Sign In with Xero for returning users) is checkpoint 1 and a hard requirement - retrofitting it into an existing signup flow is the most common source of rework.
• Connection-handling requirements are strict: you must display connected tenant names and connection status, provide working Connect/Disconnect/Reconnect buttons, handle disconnects initiated from Xero's Connected Apps screen, alert the user on connection errors, and have a process that deletes or revokes unused or expired connections. Xero's connections guide says failing these sends you back to make changes before certification proceeds.
• Over-broad or unexplained scopes are rejected - request the minimum and expect to justify each one. offline_access is a stated certification requirement.
• Granular scopes: apps created on or after 2 March 2026 use them by default; older apps have until September 2027 to migrate off broad scopes, and granular scopes only became requestable from April 2026.
• The app name cannot contain the word 'Xero' and must match your go-to-market product name.
• You cannot mix tenant types in one authorisation - accounting scopes and Practice Manager scopes need separate auth flows, or the user gets an error.
• The security step is a self-assessment, not certification: you must pass it before reaching 1,000 connections or touching the Practice APIs. Until then your connections are capped at 999 and XPM/Xero HQ are closed. Xero only sends you the assessment at 800 connections or when you request XPM access, so it lands late in the ramp.
• Custom Connections only work for Xero organisations in Australia, New Zealand, the UK and the US, only against one organisation each, cannot access Xero Practice Manager or Xero HQ, and require the customer to have bought a Custom Connection subscription before they can authorise.
• Xero's developer terms now prohibit using data obtained from Xero APIs to train AI/ML models, and prohibit bots or browser extensions that simulate user actions (new developers from 4 December 2025, existing from 2 March 2026).
• The 25-tenant uncertified cap in the connections guide and the 5-connection Starter tier in the pricing table are documented separately and do not read as one consistent number - confirm your app's actual limit on the usage tab of the developer dashboard rather than assuming.