Source type

Xero Source Configuration

Xero sources receive accounting webhook events and verify Xero's intent-to-receive and delivery signatures.

XEROPOST, PUT, PATCH, DELETEWebhook Signing KeyCommerce
Xero webhooks documentationAll source types
Xero sends webhook traffic to a FastHook source, FastHook validates the provider contract, records the request, and routes accepted events through connections to destinations.XeroProviderPOST, PUT, PATCH, DELETESignedFastHookSource URLXEROProvider credentialsignatureVerify before queue401 on auth failure405 on wrong methodAcceptedRequestverified: trueConnections route the accepted request to destinationsFilters, transformations, retries, replay, and destination signatures stay downstream from source verification.

Xero configuration

Create a Xero source, keep POST and PUT and PATCH and DELETE enabled, and provide the configured Webhook Signing Key values for provider signature. FastHook uses these settings to validate each Xero delivery before it enters the routing workflow.

Source Type

XERO

Allowed methods

POST, PUT, PATCH, DELETE

Authentication

Provider signature

Credential fields

Webhook Signing Key

Xero source config
{
  "type": "XERO",
  "config": {
    "auth_type": "PROVIDER_SIGNATURE",
    "auth": {
      "provider": "XERO",
      "webhook_signing_secret": "provider-secret"
    },
    "allowed_http_methods": ["POST","PUT","PATCH","DELETE"]
  }
}

Xero request contract

FastHook computes a base64 HMAC-SHA256 digest over the raw body and compares it to x-xero-signature.

POSTPUTPATCHDELETE

Xero headers

Preserve x-xero-signature when sending Xero test deliveries. FastHook evaluates this request context before accepting the payload, so missing or modified values remain visible as rejected requests instead of routed events.

x-xero-signature

Base64 HMAC-SHA256 signature over the raw body.

Xero setup

  1. Configure the Xero webhook URL with the FastHook Source URL.
  2. Paste the Xero webhook signing key into FastHook.
  3. Use FastHook request records to inspect intent-to-receive validation attempts.

Continue with Xero