Business software integration is the work of connecting two systems, such as your accounting software and your CRM, so that data moves between them through an API instead of being retyped. It works well when the integration handles three things your staff never see: signing in without passwords, staying under the other system's call limits, and recovering when a message goes missing. This guide explains each one using the Xero and MYOB developer documentation, and ends with the questions to ask whoever builds yours.
What an integration does between two business systems
Most small businesses run several systems that were never designed to work together: accounting, a CRM, a booking tool, an online store.
A CRM, as business.gov.au puts it, records contacts between you and your customers and gives a single view of a customer's history, needs and preferences. That view only stays true if the CRM learns about invoices raised in accounting, and accounting learns about new customers entered in the CRM.
The connection runs through an API (application programming interface). MDN describes an API as a set of features and rules inside a program that lets other software interact with it, as opposed to a screen a person clicks through.
An integration is the code in the middle. It decides which records move, in which direction, how often, which system wins when both changed the same field, and what happens when a request fails. Our earlier guide to connecting Xero to your CRM walks through one such link from start to finish; this one covers the parts every integration shares.
How sign-in consent works without sharing passwords
A sound integration never asks for your accounting password. Xero's developer documentation describes OAuth 2.0 as a protocol that lets an app access a user's account without accessing their password. You sign in on Xero's own page, see what the app is asking for, and approve it.
Xero calls each connected organisation a tenant. A user can connect one app to several tenants, and a tenant can be a Xero organisation, a Xero HQ practice or a Xero Practice Manager account.
MYOB works the same way. Its documentation says the MYOB Business API uses OAuth 2.0 and that an app is not allowed to ask for a user's my.MYOB credentials; it must send the user to MYOB's own secure login page. If a supplier asks you to email your MYOB login so they can "set up the sync", stop there.
Consent does not last forever on its own. MYOB says access tokens have a limited life span, that each one comes with an expiry time and a refresh token, and that an expired token cannot reach the API until the integration triggers a refresh. A good integration refreshes in the background; a weak one simply stops one morning.
Why calls are limited, and what happens at the limit
Every request an integration sends is a call, and accounting platforms ration them so one busy app cannot slow the service for everyone. Xero publishes its limits on its API limits page, and they are counted per tenant.
| Xero limit | Figure in Xero's documentation | What it means for your business |
|---|---|---|
| Calls in progress at one time | 5 per tenant | A sync that fires many requests at once has to queue them |
| Calls per minute | 60 per tenant | A bulk import of old invoices has to be paced, not pushed through in one burst |
| Calls per day | 1,000 on the starter tier, 5,000 on higher tiers | A busy store or a frequent sync can run out of calls before the day ends |
| Calls across all tenants | 10,000 per minute per app | Mainly matters for software serving many businesses |
When a limit is exceeded, Xero answers with an HTTP 429 response, which means "too many requests". What happens next depends entirely on how the integration was written. A careful one notices the refusal, waits, and sends the call again. A careless one treats it as a final error and moves on, so an invoice or a payment never arrives on the other side.
Limits are also why "sync everything every minute" is rarely the right design: a good integration sends only what changed.
Webhooks: when the other system tells yours that something changed
Your software can keep asking another system whether anything changed, which spends calls, or that system can tell it. The second approach is a webhook.
Xero's documentation says webhooks let you subscribe to certain events, and when one happens Xero sends an HTTP POST message to the address you configured. Your integration receives that message and fetches the details it needs.
Xero sets rules for that receiving address: it must use HTTPS on the standard 443 port and answer within 5 seconds with a 2xx status code, meaning "received". If Xero does not get an acceptable answer, it keeps retrying with decreasing frequency for up to 24 hours. An integration that is down for longer can quietly miss changes unless it also checks for gaps.
What can go wrong once it is live
Most integration problems are not dramatic. They are small gaps that grow because nobody is watching. The common ones:
- Lapsed consent: a token expires or the person who approved the connection leaves, and the integration loses access.
- Hitting a limit: a month-end batch or a sale weekend runs the calls out, and failed calls are not retried.
- Missed webhooks: the receiving address is down beyond the retry window, so changes never arrive.
- Duplicates: a retried call creates the same contact or invoice twice because the integration does not check whether it already exists.
- Exposed keys: credentials sit in the code. OpenAI's API key safety guidance says never to commit a key to a repository and calls doing so a common route to credential compromise; the same discipline applies to any integration's secrets.
Each has a plain technical answer, decided before launch rather than after the first missing invoice.
Questions to ask before you approve an integration
You do not need to read code to hold a developer to a good standard. Ask for these answers in writing.
- Map the data. Ask which records move, in which direction, and which system is the source of truth for each field, such as the customer's billing address.
- Check the sign-in method. Confirm the connection uses the platform's own consent screen (OAuth 2.0 for Xero and MYOB) and that nobody needs your password.
- Ask who owns the connection. Find out which login approved it, what happens when that person leaves, and how the refresh of tokens is handled.
- Ask about limits and retries. Get them to explain what the integration does when it receives a 429, and how it avoids creating duplicates when it tries again.
- Ask about webhooks and gaps. If it relies on webhooks, ask how it catches changes it missed during an outage longer than the retry window.
- Ask where the secrets live. Keys and tokens should be stored outside the code, never in a shared document or an email.
- Agree on monitoring. Name the person who gets an alert when calls keep failing, and ask for a log your bookkeeper or manager can read.
- Get the documentation. A short written description lets another developer support it later.
The answers also tell you whether a ready-made connector will do or whether the job needs custom software; our comparison of building software or buying a subscription covers that decision in more depth.
Where integrations earn their keep
The best first integration is usually the one that removes the most retyping. For a service business it is often CRM to accounting, so a won job becomes an invoice. For an importer it can be supplier invoices: if you buy from an overseas exporter, for example a Sri Lankan export business such as Truly Ceylon, the order, the shipment and the bill all need to land in the same place, which is the kind of work our page for import and export businesses describes.
Once data flows reliably, reporting gets easier too. A dashboard is only as good as the systems feeding it, which is why our guide to dashboards your team will use starts with where the numbers come from, and why data and dashboards work often begins with an integration.
Common mistakes
- Handing over passwords. If an integration needs your login details rather than a consent screen, it is not following the platform's own rules.
- Connecting through one person's account. When that person leaves and their access is removed, the integration can stop with them.
- No owner for errors. A log nobody reads is the same as no log.
- Two systems editing the same field. Without a clear source of truth, each sync overwrites the other and staff lose trust in both.
- Testing with tiny volumes. An integration that works with ten records can fail at month end; test with a realistic batch.
Frequently asked questions
What is business software integration in plain terms?
It is a connection that lets one business system read or change data in another through an API, so records such as contacts, invoices or payments move between them without someone retyping them. The integration is the code in the middle that decides what moves, when, and what happens when something fails.
Do I have to give a developer my Xero or MYOB password to build an integration?
No. Both Xero and MYOB use OAuth 2.0, so you sign in on their own page and approve access for the app. MYOB says an app is not allowed to ask for your my.MYOB credentials, and Xero says the protocol gives an app access without its password.
What happens when an integration hits a rate limit?
The other system refuses the extra calls. Xero answers with an HTTP 429 (too many requests) response once a limit is exceeded. A well-built integration slows down and tries again later.
What is the difference between a webhook and an API call?
With an API call, your integration asks the other system for data or sends it a change. With a webhook, the other system sends a message to your integration when an event happens, so your software learns about the change without asking over and over.
How do I know if an integration has stopped working?
Only if someone built a way to tell you. Ask for monitoring that alerts a named person when calls keep failing, consent has lapsed or webhook messages stop arriving, plus a log you can read.
If you want a second pair of eyes on an integration you already run, or a plan for a new one, our business systems and integrations team can help. Ask for a free first consultation: you receive a written quote before any work starts, and you own the code, data and documentation we deliver.
Key takeaways
- An integration is code between two systems that moves data through their APIs; its quality decides whether your records stay in step.
- Xero and MYOB use OAuth 2.0: you approve access on their own page, and nobody needs your password.
- Xero limits calls per tenant and answers 429 when a limit is exceeded, so retries and pacing matter.
- Webhooks save calls, but Xero stops retrying after 24 hours, so an integration needs a way to catch gaps.
- Ask for monitoring, a named owner for errors and written documentation before you approve the work.