How Xero authentication works: Xero uses OAuth 2.0 — when you or an app connects to Xero, Xero issues two tokens: an access token (valid for 30 minutes) and a refresh token (valid for 60 days). The connected app uses the refresh token to get new access tokens automatically. If the refresh token expires (no activity for 60 days), or is revoked (you disconnected the app, changed your password, or the app developer rotated credentials), the app cannot get a new access token and every request returns 401. The fix is always to re-authorise — start a fresh OAuth flow.

Error code

401

HTTP · Unauthorized

Related: 400 · 403 · 404 · 500

What it means

HTTP 401 "Unauthorized" means the request arrived at Xero's servers but could not be authenticated — there is no valid identity attached to it. Unlike 403 (authenticated but not permitted), 401 means the authentication step itself failed: the session is expired, the token is invalid, or no credentials were provided at all.

Your Xero data is safe. A 401 is an authentication failure — your accounts, transactions, and financial records in Xero are completely unaffected. Re-authenticating restores full access.

OAuth Token Expired

Most common cause — Xero access tokens expire after 30 minutes, and refresh tokens expire after 60 days of inactivity. If a connected app hasn't synced in over 60 days (e.g. seasonal businesses), the refresh token expires and every request returns 401 until re-authorised.

App Disconnected from Xero

Someone disconnected the app from Xero (intentionally or accidentally) via Xero's Connected Apps settings. Once disconnected, all tokens are permanently revoked — the app must go through the full OAuth flow again to reconnect.

Xero Password Changed

Changing your Xero account password revokes all active OAuth tokens for security. Every connected app will return 401 after a password change until each app is individually re-authorised.

Connecting User Account Removed

The Xero user account that originally authorised the app connection has been removed from the organisation. The tokens issued to that user are now invalid and all integrations connected via that user return 401.

App Credentials Rotated

The developer of a connected app rotated their Xero API client credentials (Client ID or Client Secret) without properly migrating existing tokens. All existing connections return 401 until users re-authorise through the app.

Session Expired in Browser

Your Xero browser session has timed out after inactivity. Xero automatically logs out sessions after extended periods of inactivity for security. Logging back in creates a fresh session and resolves the 401 immediately.

METHOD 1 Log Out and Back Into Xero Scenario A — 401 in your Xero browser session

If 401 appears when you are trying to use Xero in your browser, your session has expired. A complete logout and fresh login creates a new valid session token.

METHOD 2 Reconnect the App to Xero Scenario B — 401 in a connected app (Shopify, payroll, CRM, etc.)

When a connected app's Xero integration shows 401, the OAuth token has expired or been revoked. The fix is re-authorising the connection — this takes 2 minutes and is safe to do without affecting any data.

METHOD 3 Check Xero Connected Apps and Remove Stale Connections If reconnect in the app doesn't clear the 401

Sometimes an old, broken connection to the same app exists in Xero's Connected Apps list and is conflicting with the new reconnect attempt. Removing the stale connection from Xero's side forces a completely clean OAuth flow.

METHOD 4 Re-Authorise After a Password Change If multiple apps failed at the same time

If multiple connected apps all started returning 401 at the same time, a Xero password change is almost certainly the cause — it revokes all OAuth tokens across all apps simultaneously. Each app must be individually re-authorised after a password change.

METHOD 5 Check User Roles and Organisation Access If reconnect succeeds but 401 returns immediately

If you reconnect successfully but the 401 returns within minutes, the user account used to authorise the connection does not have sufficient permissions for what the app is trying to do — or was removed from the organisation after the reconnect.

How is Xero 401 different from Xero 403?

The difference is at the authentication vs authorisation layer. Error 401 means "I don't know who you are" — the request has no valid credentials attached, or the credentials are expired. Error 403 means "I know who you are, but you can't do that" — the request is authenticated, but the authenticated user does not have permission for the requested action. Fix a 401 by re-authenticating (log back in, reconnect OAuth). Fix a 403 by changing permissions or user roles — re-authenticating will not help.

Will reconnecting my app to Xero lose any historical sync data?

No — reconnecting an app simply generates a new OAuth token. It does not delete or reset any data that has already been synced between the app and Xero. Your historical invoices, contacts, transactions, and reconciliation records in Xero are unaffected. What may happen is a re-sync of recent transactions once the connection is restored — check the app's sync settings to confirm whether it will attempt to backfill any missed transactions from the period when 401 was active, and whether that could create duplicates.

How do I prevent Xero 401 from happening again?

Three practices prevent most recurring 401s. For seasonal businesses that don't use connected apps year-round — manually trigger a sync or log into each connected app at least once every 60 days to prevent refresh token expiry. When a staff member who manages Xero integrations leaves — reconnect all integrations under an active user account before removing the departing user. When changing your Xero password — schedule time immediately after to reconnect all connected apps, as all tokens are revoked simultaneously. If you manage many integrations, keep a list of all connected apps (Xero → Settings → Connected Apps) so you know exactly how many need reconnecting after a password change.