Xero and Slack integration

What moves between them

Xero invoice, payment, and manual journal events flow into Slack. When an event occurs in Xero, ml-connector receives the webhook notification or polls the API, retrieves the full record, formats it as a human-readable message, and posts it to a pre-configured Slack channel. Payment notifications include the contact name, amount, invoice reference, and date. Invoice posts show invoice number, amount, due date, and status. Manual journals include the account codes, line descriptions, and amounts. The flow is one-way: Slack does not send data back to Xero. Posts are threaded by invoice or contact so related notifications stay grouped.

How ml-connector handles it

ml-connector authenticates to Xero using OAuth2, stores the refresh token encrypted, and reuses the access token until the 30-minute window closes, then silently refreshes. When Xero sends a webhook notification, ml-connector verifies the signing key matches, extracts the resource ID, fetches the full record via the Accounting API, and formats it as a Slack message block. For Slack, ml-connector trades the Xero OAuth client ID and secret for a Slack bot token that never expires, stores it encrypted, and uses Bearer authentication on every POST to chat.postMessage. Before each post, ml-connector verifies that the target channel exists via conversations.info and respects the 1-per-second rate limit per channel by queuing posts and consuming the queue at safe intervals. Slack Events API webhook requests arrive with a timestamp and signature in the X-Slack-Signature header; ml-connector computes HMAC-SHA256 over the timestamp and request body using the Slack signing secret, verifies it matches constant-time, and responds 2xx within 3 seconds. If a post to Slack fails due to transient error or rate limiting, ml-connector stores the formatted message and retries with exponential backoff, and includes a full audit log of every post attempt.

A real-world example

A small accounting firm uses Xero for client bookkeeping and Slack for team coordination. Before the integration, invoices and payments were email notifications to the finance team, which were often missed or buried in the inbox. With Xero and Slack connected, every new invoice and payment posts automatically to a client-financials channel where the team can see it in context with related messages. When a payment is recorded, the client-financials channel gets a brief message with the client name, amount, and date, and team members can discuss exceptions right there. Month-end manual journal entries post in a dedicated thread so the full audit trail is visible to anyone who needs it. The finance team no longer relies on email to stay informed and can spot late payments or double-entries in real time.

What you can do

• •Post Xero invoices and purchase orders to Slack channels with invoice number, amount, due date, and status.
• •Send payment notifications to Slack with contact name, amount, invoice reference, and payment date.
• •Deliver manual journal entries to Slack with account codes, line descriptions, and amounts for audit visibility.
• •Authenticate Xero with OAuth2 and manage token refresh, and authenticate Slack with non-expiring bot tokens and HMAC-SHA256 signature verification.
• •Queue posts to respect Slack's 1-per-second rate limit per channel and replay failed posts with exponential backoff and full audit trail.

Questions

Which direction does data flow between Xero and Slack?

Data flows one way: from Xero to Slack. Invoices, payments, and manual journals from Xero are formatted and posted to Slack channels as messages. Slack does not send data back to Xero; Slack is the notification endpoint, not a data source.

How does ml-connector handle Xero and Slack token expiry?

Xero access tokens expire after 30 minutes, so ml-connector caches the refresh token and silently refreshes the access token when needed. Slack bot tokens do not expire; they remain valid until revoked by the workspace administrator or explicitly revoked via the auth.revoke endpoint.

What happens if a Slack post fails or exceeds the rate limit?

ml-connector queues the formatted message and respects Slack's 1-per-second limit per channel by consuming the queue at safe intervals. If a post fails due to a transient error or reaches the rate limit, ml-connector retries with exponential backoff, and every attempt is logged in the audit trail so you can verify delivery.