MYOB and PayPal integration

What moves between them

The primary flow is MYOB to PayPal. Customer records and sales invoices from MYOB are synced to PayPal invoicing so payment collection can begin. PayPal transaction records are read back on a daily schedule (constrained by PayPal's 31-day search window) and matched to MYOB GL accounts and customer payments by amount and date. Supplier records flow one-directionally from MYOB to PayPal payouts, though payouts target email addresses and require PayPal account details at setup time. Customer and item master data may be synchronized bidirectionally if changes originate in either system, with conflict resolution by most-recent LastModified or transaction timestamp.

How ml-connector handles it

ml-connector stores both credential sets encrypted and manages the refresh cycle on each side: MYOB tokens refresh every 20 minutes using the refresh token, while PayPal bearer tokens are cached and refreshed on 401 response. On every MYOB call, it presents the OAuth2 bearer token plus the company file username and password in custom headers to satisfy MYOB's two-factor auth requirement. Polling uses OData $filter on LastModified timestamps to detect changes since the last sync, with $top capped at the MYOB page size limit of 1000. PayPal transaction reads are constrained to the 31-day rolling window, so ml-connector maintains a cursor to walk forward incrementally and avoid gaps. PayPal's RSA-SHA256 webhook signature is verified on receipt against the transmission-sig header, and signatures that fail are rejected before processing. Invoices synced to PayPal are posted to the send endpoint to notify customers. MYOB's strict rate limits (8 requests/second, 1M/day) are respected via backoff and jitter on 429 responses. RowVersion conflicts on PATCH/PUT are handled by re-reading the record and retrying with the current version. All records carry a full audit trail and are deduped via BullMQ jobId to prevent double-posting if a network error occurs between the queue and the target system.

A real-world example

A mid-sized Australian consulting firm uses MYOB for invoicing and GL management, and PayPal to process client payments and collect international subscription fees. Before the integration, the finance team exported invoices from MYOB weekly, manually uploaded them to PayPal, tracked which ones had been paid by hand, and re-entered PayPal transaction records into MYOB's cash receipts register at month-end. With MYOB and PayPal connected, new invoices post to PayPal automatically when created in MYOB, clients pay through PayPal, and the payments flow back into MYOB's sales ledger without manual intervention. Month-end close is faster because the cash receipts and AR aging are already reconciled.

What you can do

• •Sync customers and sales invoices from MYOB to PayPal, with automatic notify-to-recipient on send.
• •Read PayPal transactions on a daily schedule, constrained to the 31-day search window, and match them to MYOB customers and GL accounts.
• •Manage MYOB's 20-minute token refresh cycle and PayPal's OAuth2 bearer token cache, refreshing on 401.
• •Present MYOB company file credentials on every API call to satisfy two-factor auth, alongside the OAuth2 bearer token.
• •Respect MYOB's rate limits (8 req/second, 1M/day), verify PayPal RSA-SHA256 webhook signatures, and deduplicate writes via BullMQ jobId.

Questions

How does the integration handle MYOB's two-factor auth requirement on company file credentials?

MYOB requires both an OAuth2 bearer token and a company file username and password sent in custom headers (x-myobapi-cftoken and x-myobapi-key) on every API call. ml-connector stores all three encrypted and presents them on each request, managing the OAuth2 token refresh every 20 minutes while keeping the company file credentials valid throughout the session.

Why is PayPal transaction reading limited to a 31-day window?

PayPal's transaction search API only returns transactions from the past 31 days. ml-connector maintains a cursor to walk forward incrementally day by day, so it captures all new transactions without gaps but cannot backfill historical data beyond 31 days. Invoices and orders older than 31 days are already reconciled and do not need re-sync.

How does the integration verify PayPal webhook signatures?

PayPal signs every webhook event with RSA-SHA256 using the paypal-transmission-sig header. ml-connector verifies the signature against the public key before processing any webhook, rejecting unsigned or forged events. This prevents replay attacks and ensures only authentic PayPal events are written to MYOB.