How MYOB Authentication and Connection Works

Source: myob_controller.rb, company.rb

• Generating a MYOB token has a silent side-effect: it forces calculate_tax_on_subtotal to true on the company, which changes how tax is calculated on all future invoices
• The company file token is constructed by Base64-encoding the username and password together (username:password format)
• MYOB API connections use TLS 1.2 with SSL verification set to VERIFY_NONE — the certificate is not validated
• HTTP 401 and 403 responses are both mapped to the same error message: "Access Denied, Verify Your Company File Username And Password"
• Connection validity requires BOTH an access token AND a refresh token to be present — if either is missing the connection is treated as invalid
• Company file setup requires four pieces of information: the auth token, the company file ID, the company file name, and the MYOB username

Support scenarios

• "Tax calculations changed after I connected MYOB" → Connecting MYOB silently sets calculate_tax_on_subtotal to true. This is by design but is not communicated to the user. If the previous setting was different, tax on existing quotes and open invoices may look different.
• "I'm getting 'Access Denied' from MYOB but my credentials are correct" → Both 401 and 403 return the same generic message. The issue could be expired tokens (not just wrong credentials). Try re-authenticating the MYOB connection entirely.
• "MYOB connection shows as invalid even though I just authenticated" → Both an access token AND a refresh token must be present. If the initial auth only returned one, the connection is treated as invalid. Re-authenticate to obtain both tokens.