node-oauth | OAuth wrapper for node.js | Runtime Evironment library

Unfortunately, SPAs are not compatible with the Xero API.

You'll need a web server to manage your local session (OAuth flow, storage of Xero API tokens), and for your interactions with the Xero API.

While SPAs are a tempting option (they are convenient from a deployment point of view), there are changes coming to how browsers handle cross-site cookies, which break how SPAs perform session management.

I'd suggest reading https://leastprivilege.com/2020/03/31/spas-are-dead/ for more information and a discussion of the implications. The authors of the article created OIDC Client JS which is a great library for doing PKCE-based SPA auth in the browser, though it's only useful for same-domain applications now thanks to the impending browser cookie changes.

Further to this, the Xero API does not support CORS, so even once you complete the OAuth flow, the browser would be prevented from performing API requests from your Angular SPA.

To answer the specific questions:

1) The user will need to log in to Xero and grant consent for your app the first time they use your application. If you're storing server-side refresh tokens after the initial consent, your user will only need to log in to your local session, either via Xero SSO or another mechanism (user/password).

2) To create the initial Authorisation Request, it's best to use the node.js starter app. It will manage the OAuth redirect flow for you (it uses the excellent openid-client open source package for this).

You have a simple typo in your mySql.js file:

The line

Easier than I thought. I simply added () to the end of the loadExampleData function and started the server. This caused the loadExampleData function to execute on startup and load the data. Just had to remove the () after running once so that the data does not load each time. var loadExampleData = function() { load functionality }(); ^ | Added the () and removed after loading once.