Reminder: Update your MYOB Business API integrations by 1 September 2026

Hi Stuart, 

Well, done on getting this out there so early :-) Is this already in place so that I can test and start releasing to Clients?

Thanks

Trish

Hi Trish,

Yes, the granular consent model is already in place, so we would recommend updating your apps as soon as possible. If you have any questions on the new granular scopes or other issues, please submit a new support request below:

MYOB Business (AccountRight) API Support Ticket Form

Currently with my.myob acting as OAuth - the auth that is provided is for the User, and thus the resources returned available for accesss are ALL companies the user has permissions for.

In the case where a my.myob user has access to multiple companies - are they required now to select a specific company, and the code/auth returned then is only for that 1 single company, not for all companies that the user has access to (an OAuth resource flow not a user flow)?

Hi cas-tag​ that is correct. Authorisation is for one file now, which is selected after submitting a request and being prompted to log in with your email/password. You must have the file admin role to authorise.

Just getting my head into this.  I've made the changes to my app's authorisation URL and I do get the MYOB page come up that spells out what is being requested and invites the user to Connect.  But when I do that I get a message that says "Something went wrong and we couldn't connect the app".  Below that it says that I need to be an administrator on the company file to be able to connect.  I'm not an admin and I'm not sure my client would want me to be an administrator - is there some mechanism in place to enable testing and development?  Is this this app connection is a one-time thing, or will it happen every time?  Can I do something in my developer account to get me past this?  The app in question is registered in my account.

Hi MYOB Developer Team

I have just become aware of this issue.  I do not seem to be receiving any important updates from the MYOB Developer team, does MYOB actually email the MYOB Developers registered email addresses about really important changes to their API ?  I have searched through my emails and cannot see any communication about this.  I fortunately was reviewing my post and also posting a new issue when I came across this but would have loved to know about it in November 2025 which it was launched. 

DavidDNCS​ , there is no other option, to authorise file access you must be a file admin. Your client can give you that role temporarily, and even make your file access read-only until authorisation is complete. (The authorisation from your app will still work).

That error message could also relate to an invalid redirect. There are much stricter rules about redirects now, as the API support write to me:

“validation of the redirect URI has been tightened. As a result, non-HTTPS, localhost-style, or internal hostnames (like http://desktop) may now be rejected during the final redirect step after consent. When that happens, it surfaces as a generic “unable to connect, something went wrong” message, which is what you were seeing”. (This strict application was not notified.

Thanks for this info, I am one more step along the way.  I believe it was my http://desktop redirect URL that was the stumbling block, and changing it to https://desktop in my registration and in my code got me connected, I think.  However I now have another problem: the code I get back in the businessID field is just a string.  Where I make a call to the API in my .NET SDK code, I specify the company file as a CompanyFile object, as required.  I can't see any variation on the call to specify the Company File as a string or a URI.  Neither can I see any way to create a CompanyFile object from the string or a URI.  In the past I have used the API to request a list of available Company Files and I get back a list.  If there's only one I would just connect to it, otherwise I would show a dialog and let the user select.  But this is all done at the MYOB end now, so it is not clear to me how to use this businessID in my .NET SDK code.  If I try to use it, or a Uri created from it, in place of the CompanyFile object I have been obtaining up to now, the code will not even compile.  The documentation on developer.myob.com still describes these Company File mechanisms and does not appear to have been updated for the granular scopes changes.

After spending more time on this it is even less clear.  If, as stated above, the CompanyFile endpoint will be disappearing, will there even be CompanyFile objects in the .NET SDK?  If not then then the SDK will need changes to all the calls that request data.  If there will still be a CompanyFile object, there will need to be a way to derive one from the businessId that is returned by the new control flow.  I've seen nothing about any changes to the SDK, I am using the latest version and its last change was about a year ago.  What am I missing here?

Hi MarshallArts​ , have a look at the authorisation guide (V2) here:

MYOB OAuth2.0 Authentication Guide – Support for the MYOB family of SME product APIs

It addresses the business ID question; this is (or should be) contained in the redirect response. If it isn't, then your redirect may still be invalid. (We had to do a lot more than add an 's'!).

The guide's example redirect response is:

https://yourapp.com/redirect? code=...&scope=...&state=... &businessId=5d4b1ce0-bb9f-4f4c-9578-2b168b7295db &businessName=MYOB+Shared+Sandbox+21

The businessID takes the place of the company file uri (abbreviated to cf_uri in the documentation). I've not used the SDK, someone else may be able to advise you.