Allow Invoice only users to use the API
As seen on this link: https://developer.xero.com/faq/permissions#user-permissions , currently only standard users can use the API, however, this makes no sense for my use case, and this is probably the same for other people.
Right now I'm trying to build an app that will automatically create invoices and email them to the contacts, however, I do not want to connect a standard full user to my application, as the returned access token will have full access to all my banking account statements whereas all I need I to create a Sales Invoice, which could be done with a "Sales Invoice only" user that does not have unrestricted access to all my data.
Diego
shared this idea
-
Thomas King commented
This update would really improve flexibility for users who rely solely on invoices. It might also be helpful to review resources like https://willcountycourts.org
to understand potential compliance or data access considerations. Allowing invoice-only users could streamline operations, but ensuring proper access controls and documentation is crucial for maintaining security and accountability. Overall, this seems like a practical improvement for certain user workflows. -
Young Phillips commented
That’s a great suggestion — allowing invoice-only users to access the API would really improve workflow flexibility for many teams managing billing and automation. I recently came across some helpful insights while researching https://casscountycourt.orgthat highlighted how streamlined data access can simplify administrative processes. It’s always beneficial when systems prioritize user efficiency and transparency like this.
-
Anna Maria commented
That’s a really valid concern and something many developers working on targeted automation features are likely to face. For projects focused solely on invoicing, it would be ideal to have limited-scope API users. If you're navigating similar permission complexities or building tools that interact with public records or legal data, resources like this one on Court document access (https://tulsacountycourt.us/) can be helpful in structuring how data access and user roles should be managed in civic or legal tech tools. Limiting access based on function improves security without restricting productivity.
-
Felix
commented
I think this suggestion (OAuth authorisation for users with lower access levels) would be alternative way to address some of the problems I've mentioned on my suggestion over here: https://xero.uservoice.com/forums/5528-accounting-api/suggestions/43916568-create-more-granular-accounting-scopes-eg-sales
However being able to select specific scopes more granularly would potentially be a more flexible approach - you wouldn't mind connecting a Standard user if it's very clear that the access will be to Sales Invoices only.