Which direction does data move between MYOB and Square?

The main flow is Square into MYOB. Payments, invoices, and orders move from Square into MYOB, where they are posted to accounts receivable and the GL. Customer records are aligned in both directions so MYOB customer lists match Square. MYOB is read-only from the GL side; ml-connector does not post GL entries back into Square.

How does the integration handle MYOB's three-header authentication requirement?

Every MYOB API call requires the Authorization Bearer token, x-myobapi-key header with an API key, and x-myobapi-cftoken header with Base64-encoded company file credentials. ml-connector stores all three encrypted, constructs the cftoken header on every call, and refreshes the bearer token every 15 minutes to avoid the 20-minute expiry. If a token expires mid-request, ml-connector retries with a fresh token.

How does ml-connector prevent duplicate payments or invoices in MYOB?

Square payment IDs and order IDs are stored in MYOB custom fields during the first sync. On subsequent syncs, ml-connector checks for existing records by looking up the Square ID before posting, preventing duplicate entries. If a Square payment has been partially posted, the custom field lookup retrieves the matching MYOB payment and skips the re-post.

MYOBSquare

MYOB and Square integration

MYOB runs accounting and GL in Australia and New Zealand. Square processes payments and manages customer orders. Connecting the two keeps your accounts receivable and payment records in sync without manual reconciliation. Square payments and invoices flow into MYOB, mapped to your customer and payment accounts, while customer records are aligned across both systems. ml-connector handles the different APIs and the three authentication steps MYOB requires.

How MYOB works

MYOB exposes contacts, invoices, customer payments, sales orders, general ledger accounts, and inventory items through the MYOB Business API (AccountRight Live API v2), a REST interface secured with OAuth2 Authorization Code flow plus a company file username and password supplied on every call. Every API call requires three headers: an Authorization Bearer token, the x-myobapi-key header with an API key, and the x-myobapi-cftoken header with Base64-encoded company file credentials. Access tokens expire in 20 minutes, and refresh tokens last one week. MYOB exposes no webhooks on the Business API, so records are read by polling with OData v3 query parameters using LastModified timestamps to detect changes.

How Square works

Square exposes payments, invoices, customers, orders, vendors, inventory, and catalog items through a versioned REST API. Every call uses OAuth2 Bearer token authentication with a 30-day access token expiry. Square also supports webhooks for payment.created, payment.updated, refund.created, invoice.created, invoice.published, invoice.updated, order.created, and order.updated events, with HMAC-SHA256 signature verification. Square does not expose a GL Accounts or Chart of Accounts API, as it is a commerce layer designed to feed financial data to an external accounting system like MYOB.

What moves between them

The main flow runs from Square into MYOB. Square payments are synced to MYOB as customer payments, mapped to the correct MYOB customer and GL account. Square orders and invoices flow into MYOB as sales invoices, with payment status reflecting the Square payment state. Customer records are aligned in both directions so MYOB customer lists match Square customer data. The flow runs on a schedule you define, typically tied to your business day cycle.

How ml-connector handles it

ml-connector stores both credential sets encrypted. For MYOB, it caches the OAuth bearer token and refreshes it every 15 minutes to avoid the 20-minute expiry; every API call includes the three required headers: Authorization Bearer token, x-myobapi-key, and x-myobapi-cftoken with the Base64-encoded company file credentials. For Square, it receives webhooks for payment and invoice events when they occur, with HMAC-SHA256 signature verification on each call, and falls back to polling if webhooks are not enabled. When writing to MYOB, ml-connector tracks the RowVersion field on each contact and invoice record; updates require the current RowVersion, and a stale RowVersion returns a 409 conflict that ml-connector retries with a fresh read of the record. Square payment IDs and order IDs are stored in MYOB custom fields to prevent duplicate posting, and the mapping is verified at sync time so no invoice or payment lands on the wrong customer or GL account.

A real-world example

A mid-sized e-commerce or retail business uses Square to process customer payments, manage orders, and capture customer information, and uses MYOB for accounting and tax reporting in Australia or New Zealand. Before the integration, the finance team exported sales and payment reports from Square weekly and manually entered them into MYOB, creating opportunities for missed or double-posted transactions and making month-end reconciliation error-prone. With Square and MYOB connected, each payment processed through Square flows directly into MYOB as a customer payment tied to the matching invoice, and each order is recorded as a sales invoice automatically. The finance team no longer re-keys data, month-end reconciliation is a data verification step instead of a detective hunt, and the GL is always current with actual Square payment activity.

What you can do

Sync Square payments into MYOB as customer payments, mapped to the correct customer and GL account.
Post Square orders and invoices into MYOB sales invoices with payment status reflecting Square transaction state.
Align customer records between Square and MYOB so your customer lists stay in sync.
Handle MYOB's three-header authentication and refresh the bearer token every 15 minutes to avoid expiry.
Track MYOB RowVersion on updates to prevent conflicts and retry with a fresh record read on 409 responses.

Questions

Which direction does data move between MYOB and Square?: The main flow is Square into MYOB. Payments, invoices, and orders move from Square into MYOB, where they are posted to accounts receivable and the GL. Customer records are aligned in both directions so MYOB customer lists match Square. MYOB is read-only from the GL side; ml-connector does not post GL entries back into Square.
How does the integration handle MYOB's three-header authentication requirement?: Every MYOB API call requires the Authorization Bearer token, x-myobapi-key header with an API key, and x-myobapi-cftoken header with Base64-encoded company file credentials. ml-connector stores all three encrypted, constructs the cftoken header on every call, and refreshes the bearer token every 15 minutes to avoid the 20-minute expiry. If a token expires mid-request, ml-connector retries with a fresh token.
How does ml-connector prevent duplicate payments or invoices in MYOB?: Square payment IDs and order IDs are stored in MYOB custom fields during the first sync. On subsequent syncs, ml-connector checks for existing records by looking up the Square ID before posting, preventing duplicate entries. If a Square payment has been partially posted, the custom field lookup retrieves the matching MYOB payment and skips the re-post.

Connect MYOB and Square

Free to use. Add your credentials, ping your real systems, and see if we fit.

Get started