Pennylane vs Xero API + MCP

Pennylane

The v2 API has per-resource read and write scopes, an OpenAPI definition on every reference page, llms.txt and a breaking-change process that ran over 24 weeks. Access needs a paid Essentiel plan or partner approval, creation endpoints are not idempotent, and the API agreement lets Pennylane change or revoke the API without notice.

Xero API + MCP

Granular OAuth scopes, such as accounting.reports.profitandloss.read, required for apps created from 29 April 2026. Developer docs, including the per-minute rate limits, only render with JavaScript.

Pennylane

1. Call GET https://app.pennylane.com/api/external/v2/me first to confirm the token, user and company context
2. Stay under 25 requests per 5 seconds per token and wait for the retry-after value on a 429
3. Do not retry a create after a timeout without checking first. Only supplier invoice imports are deduplicated
4. Send filter and sort again with every cursor. The cursor stores position only
5. Send amounts as strings such as "120.00", and ask for :readonly scopes when the task only reads
6. Use the MCP server for reads only. It cannot create, edit or delete, and firm connections need company_id

Xero API + MCP

1. Send xero-tenant-id on every call. The token alone doesn't name the organisation
2. A bill is an Invoice with Type ACCPAY, a sales invoice is ACCREC. There's no separate bills endpoint
3. Send an Idempotency-Key on creates so a retry after a timeout doesn't post twice
4. Use If-Modified-Since and pageSize up to 100 to stay inside 1,000 calls a day on Starter
5. Set XERO_SCOPES to read scopes only when the agent shouldn't write. The MCP still lists its write and delete tools