---
title: "NetSuite and Xero: OAuth tokens and API fields"
description: "Operational reference for NetSuite and Xero token registration, admin role, and post-connect sync behaviour."
locale: en
canonical: https://www.ninonai.com/en/guides/erp-oauth-netsuite-xero-api
last_updated: "2026-04-30"
---

# NetSuite and Xero connectors: register tokens via API

These routes store OAuth tokens encrypted server-side and emit a sync signal for the organisation. Automatic GL ingestion for these providers is still an extension point: for operational intercompany scope today, combine this wiring with the CSV import described in the “General ledger: CSV…” guide.

## After the call

A background sync signal is emitted for your organisation. Connectors such as Business Central, Xero and NetSuite can persist GL lines when credentials and entity mappings are configured; for ERPs without a live connector in Ninon, use the documented ledger import.

## NetSuite — token registration endpoint

JSON body: refreshToken (string, required, minimum length 8); accessToken (optional); accountId (optional, NetSuite account / tenant id); expiresAt (optional, ISO-8601 expiry for the access token). Typical response: integration object with id, provider netsuite, externalTenantId (often from accountId), expiresAt.

## Prerequisites

Admin accounts on Ninon only. Never log refreshToken or accessToken in plain text in shared scripts or application logs.

## Xero — token registration endpoint

JSON body: refreshToken (required); accessToken (optional); tenantId (optional, instead of accountId); expiresAt (optional, ISO-8601). Typical response: integration object with provider xero and the same surfaced fields.

## Sitemap

See the full [sitemap](/en/sitemap.md) for all pages.