Connecting Xero

One connection per client, encrypted end to end.

Connect

Engagement → Data tab → Connect Xero. You'll authorize on Xero's site and return connected. Larch stores tokens encrypted (AES-256-GCM); nobody — including the UI — can read them back.

The currency guard

If the Xero organisation's currency differs from the client record's currency, syncs fail loudly rather than mixing currencies. Fix whichever side is wrong first.

Reconnecting

Three situations ask for a reconnect (Disconnect → Connect): the connection shows needs_reauth (a token refresh failed), Larch gained a new Xero permission since you connected (the sync error will say so), or you connected the wrong organisation. Reconnecting is always safe — mappings and history are untouched.

Rules

• One Xero organisation per client; the same organisation cannot be connected to two clients in a firm.
• Never connect a real organisation to a test client.