WooCommerce Xero encrypts its stored OAuth access and refresh tokens. By default, it derives the encryption values from WordPress authentication keys and salts. If a host or security tool rotates those WordPress values, the existing Xero tokens can no longer be decrypted and the connection must be restored.
Define dedicated Xero encryption constants only when WordPress key rotation repeatedly interrupts the connection. The values are server secrets: never add them to a public repository, support ticket, screenshot, or documentation example.
Note:
This is a Developer level doc. If you are unfamiliar working with code and resolving potential conflicts, we recommend you work with a Woo Agency Partner for larger projects, or find a WooCommerce developer on Codeable for smaller customizations. We are unable to provide support for customizations under our Support Policy.
Before you start
↑ Back to top- Back up
wp-config.phpand the WordPress database. - Confirm that you can reconnect the correct Xero organization and have access to the app’s current client ID and client secret.
- Use your host’s secret-management feature when available. Otherwise, protect
wp-config.phpaccording to your host’s security guidance.
Define stable Xero encryption values
↑ Back to top- Generate two different high-entropy secrets with a password manager or secret-management tool. Use at least 64 random characters for each value.
- Open
wp-config.phpthrough your host’s file manager or a secure file-transfer method. - Add the following constants above the line that says
That's all, stop editing!. Replace both placeholders with the secrets you generated.
define( 'XERO_ENCRYPTION_KEY', 'replace-with-a-unique-random-secret' );
define( 'XERO_ENCRYPTION_SALT', 'replace-with-a-different-unique-random-secret' );Do not use the placeholders
Each site needs its own unpredictable values. The key and salt must also be different from one another.
- Save the file, then go to WooCommerce > Xero. The extension warns that the authentication keys changed and disconnects the account.
- Select Sign in with Xero and reconnect the intended organization.
- Confirm that Connection status is [OK], send a test invoice, and check the WooCommerce order notes and Xero invoice.
Rotate or remove the values
↑ Back to topKeep the same values across deployments and server restarts. Changing or removing either constant makes tokens encrypted with the previous values unreadable. After any change, return to WooCommerce > Xero and reconnect the account so the extension stores new tokens with the current values.
If the site moves to another server, transfer these secrets through the host’s secure deployment process. Do not copy them into the site’s Git repository or a public configuration file.
