Can You Help Me Get The Xero OAuth2 Provider Login Working Please (CORS Error)?

Wappler General Need Help
1

Hey there anyone who has linked to Xero…
(@sitestreet, @scalaris, @Roney_Dsilva, @teodor (of course) and others…)

I seem to be stuck at the last part of getting my Xero login process working using the OAuth2 Provider… and I’d love a bit of help with it!

I’ve got it all working manually where I get the token from Xero’s ‘code’, so I know I’m close…

Manual Setup - That Works

So doing it manually, I have the first step of opening a browser window which links to the authorize api:

https://login.xero.com/identity/connect/authorize?response_type=code&client_id=8F.....46&redirect_uri=https://app.workshop-angel.com&scope=offline_access accounting.transactions accounting.contacts accounting.settings&state=x

This works and give me the code in the url of my redirect_uri.

At the moment I paste that code into a variable in a server action which then generates the access_token. The token is stored in a session variable, and I can then use that to go off and and work with the Xero API:

get_token_from_code
get_token_from_code585×830 35.3 KB

OAuth2 Provider Setup - Doesn’t Work

So as I understand, the Wappler OAuth2 Provider does both these steps in one… so somewhere in that setup I need to specify the right information.

Here is my OAuth2 Provider:

oap_xero
oap_xero472×825 24.8 KB

The redirect_uri path is: http://localhost/dmxConnect/api/external_api/xero_login.php, which is where I’m calling it from. Here is the call:

auth_query
auth_query1067×303 24.6 KB

But however I organise the params section of this, I am getting the same CORS error on the first authorization step:

cors_error

Can anyone help me understand how to fix this please? Thank you! :pray:

PS - here are my redirect URIs in Xero…

redirects
redirects570×673 10.6 KB

2

Shot in the dark but maybe because you are requesting from a non secure localhost connection?

We have had similar failures with API’s due to this very reason.

3

Thanks @Cheese… but they allow http from localhost, and the result is the same if I put my full https site…

4

Hi @Antony,
While the CORS error you’re facing is due to the restrictions set by Xero’s server, the root cause of the problem lies in their lack of support for the PKCE flow. This limitation prevents direct access to their API from browser-based applications.

Here’s a post that talks of the same:

5

Aaahhh… thank you @Roney_Dsilva, that makes sense… so I have to use my manual method.
Thank you for the feedback! :pray:

1 Like
6

Hi Anthony,
We ended up using an AWS Lambda

7

How did you use that?

8

Created a Python-based Lamda to marshall requests between the App and Xero

image
image974×721 30.6 KB

1 Like
9

Did you do this because the Wappler way just wasn’t working as you wanted it to?

10

Yes. Lambdas are very scalable by their nature - and cost-effective. Same for API gateway - from a security perspective as we inter-connect with a growing list of companies

1 Like