Access and controls for Xero data in Google Sheets

Platform documentation checked 2026-08-11 · next review 2026-11-11

Every statement on this page about Xero comes from Xero's own developer documentation, and every statement about Google Sheets, Google Workspace or Google Accounts comes from Google's own documentation. Each was retrieved on 2026-08-11 and the source is linked at the foot of the page. Platform documentation changes: Xero's scope migration alone has published milestones running to September 2027, so re-check against the linked pages after 2026-11-11.

This page describes what Xero and Google publish about their own controls. It is not a description of CrunchSync's security posture, and nothing here should be read as one — the company-level statement is on the security page, linked in the footer of every page on this site.

What a Xero connection actually authorises

A connected application does not get your Xero login. It gets a set of scopes that you approve, and Xero shows you what they are at the moment you approve them. Xero's developer documentation puts the model plainly:

• When your app is requesting authorisation from a user it will need to ask for a set of scopes. These scopes will be displayed to the user and describe what data your app will be able to access.
• You should request the minimum scopes required for whatever action that user is performing.
• Scopes are additive… Each subsequent time your app sends a user through the flow, any new scopes will be added to previously consented scopes.
• It's not possible to remove scopes from an existing access token. The only way to reduce consented scopes is to revoke the token and start again.
• To get a refresh token, you must request the offline_access scope.

The scope list is getting more specific

Xero is replacing broad scopes with granular ones, on a published timetable (checked 2026-08-11):

• Broad scopes are being replaced by granular scopes… Broad scopes will remain available until September 2027.
• Since March 2026, all new and existing Web and PKCE apps have been assigned granular scopes.
• Since 29 April 2026, all custom connections will have access to granular scopes.

The read-only report scopes a reporting tool would ask for

Xero names the granular read-only report scopes that replace the broad accounting.reports.read scope. These are the strings a reviewer sees on a consent screen, so they are worth recognising rather than skimming:

Recognising the names is the practical control here. A tool that only needs to read reports has no reason to request write scopes, and Xero's own guidance is that an application should request the minimum scopes required. If a consent screen asks for more than the job needs, that is a question to put to the vendor before approving, not after.

• accounting.reports.balancesheet.read
• accounting.reports.profitandloss.read
• accounting.reports.trialbalance.read
• accounting.reports.budgetsummary.read
• accounting.reports.executivesummary.read
• accounting.reports.banksummary.read
• accounting.reports.aged.read
• accounting.reports.taxreports.read

Xero's own limits on connected apps

Xero publishes ceilings that apply to every connected application, not to any one product (checked 2026-08-11):

The second of these catches people out. If two uncertified apps are already connected to an organisation, a third will not connect until one is removed, whatever the third app is.

• New apps default to the starter tier with 5 connections. Moving up to Core will give you up to 50 connections. To be listed on the App Store, you will need to be in the Plus tier or above.
• each organisation or practice is limited to connecting a maximum of two uncertified apps. There is no limit on connecting certified apps.

Reviewing and removing a Xero connection

Xero documents where connected apps are reviewed and what happens when one is disconnected (checked 2026-08-11):

One thing Xero's developer documentation does not state is which user role is required to authorise or disconnect an app. That answer lives on a Xero Central article whose body renders in the browser and could not be retrieved as text on this check, so this page does not state a role requirement. Confirm it inside your own Xero organisation rather than taking a figure from anywhere else, including here.

• A user may have access to multiple tenants and will choose which ones to connect to your app.
• In Xero click on the organisation name, select settings then click connected apps.
• Your app will no longer be authorised to access data for that tenant. The tenant will no longer appear as connected for that app in user's Xero organisation… If the customer wants to use your integration again, they'll need to reconnect.
• You can revoke a user's refresh token and remove all their connections to your app by making a request to the revocation endpoint.

Why a refresh is scheduled work, not an instant one

Xero's published API rate limits apply per tenant — per organisation, account or practice — and they are the reason any reporting refresh is queued rather than instantaneous. These are facts about the Xero platform and about every application connected to it (checked 2026-08-11):

Xero's own recommendation is explicit: "it may take some time to extract the required data – it is recommended that an application is structured to schedule or queue this function so there is no user expectation of an immediate response." That is worth knowing before you agree a reporting deadline that assumes a button press returns a finished pack.

• Concurrent Limit: 5 calls in progress at one time
• Minute Limit: 60 calls per minute
• Daily Limit: 1,000 calls per day for starter, 5,000 calls per day for higher tiers
• App Minute Limit: 10,000 calls per minute (across all tenants)
• Exceeding a rate limit will result in an HTTP 429 (too many requests) response. It will include an X-Rate-Limit-Problem header telling you which limit you have reached.
• Each API response you receive will include the X-DayLimit-Remaining, X-MinLimit-Remaining and X-AppMinLimit-Remaining headers telling you the number of remaining against each limit.
• If you have exceed [sic] the minute or daily limit you will also receive a Retry-After http header that tells you how many seconds to wait before making another request.
• The maximum request size limit for all APIs is 10MB.

Who can open the workbook is a separate question

Authorising a Xero connection controls what data arrives. It has nothing to do with who can read the data once it is sitting in a spreadsheet — that is governed entirely by Google's sharing model, and it is the half people forget. Google publishes these permission levels:

Alongside the per-person roles, a file carries a general-access setting. A workbook shared as "anyone with the link" is readable by anyone who is forwarded that link, regardless of how carefully the Xero connection was scoped.

• Permission level: Viewer
• Permission level: Commenter
• Permission level: Editor
• Permission level: Owner
• General access: Restricted — "only people with access can open"
• General access: "Anyone with the link"
• General access: A public option — anyone can find and open the file without signing in
• Owners can control whether viewers and commenters may download, print and copy the file.
• Owners can prevent "editors from changing permissions or sharing files".

Administrator and personal controls on the Google side

A Google Workspace administrator can decide what any third-party app may reach across the domain, using four published access states:

As an individual, third-party access to your own Google Account is reviewed separately. Google publishes that "If you remove access, the app can't access your Google Account. This may make some features unavailable."

• Trusted — App has access to all Google Workspace services (OAuth scopes), including restricted services.
• Limited — App can only access unrestricted services.
• Specific Google data — Can request data access only to scopes that you specify when configuring the app.
• Blocked — App can't access any Google data.
• Third-party access is reviewed on the Google Account "linked apps" page, myaccount.google.com/linkedapps.
• If you remove access, the app can't access your Google Account. This may make some features unavailable.
• Deleting a "Sign in with Google" link "doesn't delete your data on the app".

What nobody publishes, and what to do about it

Three questions readers reasonably ask have no published first-party answer as at this check. Recording that honestly is more useful than a confident guess, because a guess about a permission boundary is the kind of thing a team only discovers is wrong after it matters:

• Which Xero user role is required to authorise or disconnect a connected app. Xero's developer documentation states where connected apps are reviewed, but the role requirement sits on a Xero Central article whose body renders in the browser and could not be retrieved as text on 2026-08-11. Check the permission against your own Xero organisation rather than trusting a figure from anywhere else.
• Whether removing a third-party app's access to a Google Account deletes data that app already holds. Google's page does not state it. Ask the app's vendor directly, in writing.
• Whether a commenter or viewer on a Google Sheets file can change its sharing settings. Google's sharing article does not state it.

A checklist before you connect anything

Run this before authorising a reporting tool against a live Xero organisation, not after. Every item is answerable from the two platforms' own settings screens.

• Read the scopes on the Xero consent screen and check each one against the job the tool is meant to do
• Confirm how many uncertified apps are already connected to the organisation
• Decide who in your team is allowed to authorise a connection, and confirm the role requirement inside Xero yourself
• Set the workbook's general access deliberately — restricted by default, never "anyone with the link" for a file containing financial data
• Decide whether viewers and commenters should be able to download, print or copy the pack
• Diarise a review of connected apps in Xero and of linked apps in your Google Account
• Ask the vendor, in writing, what happens to data it already holds if you disconnect — neither platform publishes that answer for you