FreshBooks API vs Xero API + MCP

FreshBooks API

OAuth scopes split read and write per resource, such as user:invoices:read. Rate limits have no numbers, status code or headers.

Xero API + MCP

Granular OAuth scopes, such as accounting.reports.profitandloss.read, required for apps created from 29 April 2026. Developer docs, including the per-minute rate limits, only render with JavaScript.

FreshBooks API

1. Call /auth/api/v1/users/me first and keep both ids. Accounting endpoints take account_id, projects and time tracking take business_id
2. Serialise token refreshes. Issuing a new refresh token kills the old one at once
3. Mark an invoice as sent (action_mark_as_sent) or email it. Reports ignore drafts
4. Send x-api-version: 2023-09-25 on journal entry calls
5. Back off on any throttling response yourself. There's no Retry-After to read and no published limit

Xero API + MCP

1. Send xero-tenant-id on every call. The token alone doesn't name the organisation
2. A bill is an Invoice with Type ACCPAY, a sales invoice is ACCREC. There's no separate bills endpoint
3. Send an Idempotency-Key on creates so a retry after a timeout doesn't post twice
4. Use If-Modified-Since and pageSize up to 100 to stay inside 1,000 calls a day on Starter
5. Set XERO_SCOPES to read scopes only when the agent shouldn't write. The MCP still lists its write and delete tools