OAuth Callback Domains Explained
Configuring your callback domain
Within a Public or Partner application type, a user can specify a callback domain. This is done when creating or editing an application in the Xero Developer Centre.
Note that a callback domain is not a full url, but a domain name, IP address or hostname: localhost.
Examples of acceptable callback domains:
Examples of unacceptable callback domains:
Setting a callback URL – OAuth
The callback URL is a parameter (oauth_callback) that is set in the RequestToken OAuth call.
We will check that the oauth_callback parameter is a full url that uses the registered callback domain.
If the callback URL does not contain a domain match with the callback domain, an OAuth error is returned:
oauth_problem = parameter_rejected
oauth_problem_advice = Callback url is not the registered callback domain
If the callback parameter is not set, when a user authorizes an application, the user will not be redirected back to a webpage, but will be displayed a random number authorization code.
Callback domains and subdomains
A callback domain can be a top level domain such as xero.com, or a sub domain such as api.xero.com.
If you wish to use multiple subdomains, you can set the top level domain as your callback domain so that callback URL’s of api.xero.com and developer.xero.com would be accepted for a callback domain of xero.com
Previous Xero API Applications
In the past, Xero API applications did accept a callback URL to be configured within the application setup, and this was used as the default callback URL for an application.
As the Xero API now supports the oauth_callback parameter, new applications need to use this parameter, whereas applications with the old callback URL are continued to be supported until the they are edited, and changed to use a callback domain.