NAME
WebService::Xero::Agent::PublicApplication - Connects to Xero Public Application API
VERSION
Version 0.11
SYNOPSIS
Public Applications
Public applications use a 3-legged authorisation process. A user will need to authorise your application against each organisation that you want access to. For a great description of the 3-legged flow see http://oauthbible.com/#oauth-10a-three-legged .
For a working example that uses Mojolicious Web Framework see https://github.com/pscott-au/mojolicious-xero-public-app-demo
XERO PUBLIC APPLICATION API CONFIGURATION
Public applications are configured in the Xero Developer API Console. These setting are used in your application to access your user's Xero Accounting data through Xero's Public Application API.
Your users will be directed from your website to Xero and asked for access confirmation. If they agree your application will use an Access Token to query Xero data for the life of the session (up to 30 minutes).
You application can then access the Xero Services to retrieve, update and create contact, invoices etc.
See https://app.xero.com/Application for more detail.
TODO
METHODS
get_request_token()
Takes the callback URL as a parameter which is used to create the request for
a request token. The request is submitted to Xero and if successful this
method eturns the Token and sets the 'login_url' property of the agent.
Assumes that the public application API configuration is set in the agent ( CONSUMER KEY and SECRET )get_access_token()
When Xero redirects the user back to the application it includes parameters that
when combined with the previously generated token can be used to create an access
token that can access the Xero API services directly.INPUT PARAMETERS AS A LIST ( NOT NAMED )
$oauth_token oauth_token GET Param includes in the redirected request back from Xero $oauth_verifier auth_verifier GET Param includes in the redirected request back from Xero $org org GET Param includes in the redirected request back from Xero $stored_token_secret $stored_token
When the Xero callback redirect returns the user to the application after authorising the
app in Xero, the get params oauth_token and oauth_verifier are included in the URL whichdo_xero_api_call()
INPUT PARAMETERS AS A LIST ( NOT NAMED )* $uri (required) - the API endpoint URI ( eg 'https://api.xero.com/api.xro/2.0/Contacts/') * $method (optional) - 'POST' or 'GET' .. PUT not currently supported * $xml (optional) - the payload for POST updates as XML
RETURNS
The response is requested in JSON format which is then processed into a Perl structure that
is returned to the caller.The OAuth Dance
Public Applications require the negotiation of a token by directing the user to Xero to authenticate and accepting the callback as the user is redirected to your application.
To implement you need to persist token details across multiple user web page requests in your application.
To fully understand the integration implementation requirements it is useful to familiarise yourself with the terminology.
OAUTH 1.0a TERMINOLOGY
Authentication occurs in 3 steps (legs):
Step 1 - Get an Unauthorised Request Token
use WebService::Xero::Agent::PublicApplication;
my $xero = WebService::Xero::Agent::PublicApplication->new( CONSUMER_KEY => 'YOUR_OAUTH_CONSUMER_KEY',
CONSUMER_SECRET => 'YOUR_OAUTH_CONSUMER_SECRET',
CALLBACK_URL => 'http://localhost/xero_tester.cgi'
);
my $callback_url = 'http://localhost/cgi-bin/test_xero_public_application.cgi'; ## NB Domain must be configured in Xero App Config
$xero->get_request_token( $callback_url ); ## This generates the token to include in the user redirect (A)
## NB need to store $xero->{oauth_token},$xero->{oauth_token_secret} in persistent storage as will be required at later steps for this session.
print $xero->{login_url}; ## need to include a link to this URL in your app for the user to click on (B)Step 2 - Redirect User
user click on link to $xero->{login_url} which takes them to Xero - when they authorise your app they are redirected back to your callback URL (C)(D)Step 3 - Swap a Request Token for an Access Token
The callback URL includes extra GET parameters that are used with the token details stored earlier to obtain an access token.
my $oauth_verifier = $cgi->url_param('oauth_verifier');
my $org = $cgi->param('org');
my $oauth_token = $cgi->url_param('oauth_token');
$xero->get_access_token( $oauth_token, $oauth_verifier, $org, $stored_token_secret, $stored_oauth_token ); ## (E)(F)Step 4 - Access the Xero API using the access token
my $contact_struct = $xero->do_xero_api_call( 'https://api.xero.com/api.xro/2.0/Contacts' ); ## (G)Other Notes
The access token received will expire after 30 minutes. If you want access for longer you will need the user to re-authorise your application.
Xero API Applications have a limit of 1,000/day and 60/minute request per organisation.
Your application can have access to many organisations at once by going through the authorisation process for each organisation.
Xero URLs used for authorisation and using the API
Get an Unauthorised Request Token: https://api.xero.com/oauth/RequestToken Redirect a user: https://api.xero.com/oauth/Authorize Swap a Request Token for an Access Token: https://api.xero.com/oauth/AccessToken Connect to the Xero API: https://api.xero.com/api.xro/2.0/
AUTHOR
Peter Scott, <peter at computerpros.com.au>
BUGS
Please report any bugs or feature requests to bug-webservice-xero at rt.cpan.org, or through the web interface at http://rt.cpan.org/NoAuth/ReportBug.html?Queue=WebService-Xero. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes.
SUPPORT
You can find documentation for this module with the perldoc command.
perldoc WebService::Xero::Agent::PublicApplicationYou can also look for information at:
RT: CPAN's request tracker (report bugs here)
AnnoCPAN: Annotated CPAN documentation
CPAN Ratings
Search CPAN
ACKNOWLEDGEMENTS
LICENSE AND COPYRIGHT
Copyright 2016 Peter Scott.
This program is free software; you can redistribute it and/or modify it under the terms of the the Artistic License (2.0). You may obtain a copy of the full license at:
http://www.perlfoundation.org/artistic_license_2_0
Any use, modification, and distribution of the Standard or Modified Versions is governed by this Artistic License. By using, modifying or distributing the Package, you accept this license. Do not use, modify, or distribute the Package, if you do not accept this license.
If your Modified Version has been derived from a Modified Version made by someone other than you, you are nevertheless required to ensure that your Modified Version complies with the requirements of this license.
This license does not grant you the right to use any trademark, service mark, tradename, or logo of the Copyright Holder.
This license includes the non-exclusive, worldwide, free-of-charge patent license to make, have made, use, offer to sell, sell, import and otherwise transfer the Package with respect to any patent claims licensable by the Copyright Holder that are necessarily infringed by the Package. If you institute patent litigation (including a cross-claim or counterclaim) against any party alleging that the Package constitutes direct or contributory patent infringement, then this Artistic License to you shall terminate on the date that such litigation is filed.
Disclaimer of Warranty: THE PACKAGE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS IS' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES. THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT ARE DISCLAIMED TO THE EXTENT PERMITTED BY YOUR LOCAL LAW. UNLESS REQUIRED BY LAW, NO COPYRIGHT HOLDER OR CONTRIBUTOR WILL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING IN ANY WAY OUT OF THE USE OF THE PACKAGE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
