Xero webhooks

Contact and invoice changes in an organisation.

Events

Contact: CREATE
Contact: UPDATE
Invoice: CREATE
Invoice: UPDATE

Signature

Header x-xero-signature: HMAC-SHA256 of the raw body with the webhook key, base64 encoded. Xero sends 'intent to receive' checks that you must answer with 200 only when the signature is valid, 401 otherwise.

✓ A bin checks Xero signatures: add the webhook key under Signature verification (Xero).

Check a Xero signature with the free tool (use the Shopify preset).

Retries

Xero retries with increasing gaps and pauses the webhook after repeated failures. Payloads carry IDs only.

See a retry schedule in the calculator.

Docs

developer.xero.com/documentation/guides/webhooks/overview/

Checked 2026-10-08. Report a change.

Sample request from Xeroillustrative, shortened

Content-Typeapplication/jsonx-xero-signatureXWmrwMey6OsLMeiZKwP4Fpp…

{
  "events": [
    {
      "resourceUrl": "https://api.xero.com/api.xro/2.0/Invoices/0e64a623-c2a1-446a-93ed-eb897f118cbc",
      "resourceId": "0e64a623-c2a1-446a-93ed-eb897f118cbc",
      "eventDateUtc": "2026-10-08T06:34:00.000",
      "eventType": "UPDATE",
      "eventCategory": "INVOICE",
      "tenantId": "ec49a3b6-…",
      "tenantType": "ORGANISATION"
    }
  ],
  "firstEventSequence": 1,
  "lastEventSequence": 1,
  "entropy": "S0m3r4nd0mt3xt"
}

Receive Xero webhooks with webhooks.xyz

Create a bin. Paste its URL into Xero. Each request shows at once with its headers and body. Add your secret, and each request gets a verified or failed mark. Add your server as a destination, and deliveries retry when it is down. Request an invite.

More in accounting and erp: Microsoft Dynamics 365 (Dataverse), Odoo, Oracle NetSuite, QuickBooks Online, SAP (Event Mesh / Business Events), Zoho CRM.