How to fix ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported ERROR [HY000] [Microsoft][Xero] (1019) Unable to complete RSA Signature: error:1E08010C:DECODER routines::unsupported

Hello Anil !

Thank you for posting on Microsoft Learn.

That error means the driver is trying to do an RSA (PEM) signature and OpenSSL can’t decode the key it was given. In practice, this happens when the Xero linked service is (accidentally) behaving like OAuth 1.0a (which used RSA keys) instead of pure OAuth 2.0 or when a PEM-looking value is pasted where a client secret should go.

You need to force OAuth 2.0 in the linked service JSON where you open your Xero linked service (code view) and verify:

"type": "Xero",
"typeProperties": {
  "connectionProperties": {
    "host": "api.xero.com",
    "authenticationType": "OAuth_2.0",
    "consumerKey": { "type": "SecureString", "value": "<CLIENT_ID>" },
    "privateKey": { "type": "SecureString", "value": "<CLIENT_SECRET>" },
    "tenantId": "<TENANT_ID>",
    "refreshToken": { "type": "SecureString", "value": "<REFRESH_TOKEN>" }
  }
}

in OAuth 2.0 the field named privateKey is actually the client secret, just a plain string.

Don’t paste any -----BEGIN ... PRIVATE KEY----- blocks there, those are only for OAuth 1.0a and will trigger the RSA/DECODER error.

https://learn.microsoft.com/en-us/azure/data-factory/connector-xero

If the dropdown was set to OAuth 1.0a at any point, the driver will try to parse a PEM and sign with RSA. Switch to OAuth 2.0 and re-save. The Xero connector doc explicitly distinguishes the two and shows PEM only for OAuth 1.0a.

Hello Bhagat, Anil,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to fix all the errors.

@Amira Bedhiafi have done a lot of justice in providing best resolution, just an addition to her response on Xero refresh tokens rotate. In Xero’s OAuth 2.0 flow, every time you use a refresh token to get a new access token, you also receive a brand-new refresh token, and the old one immediately becomes invalid. If you don’t update and store the latest refresh token (for example, in Azure Key Vault), future connection attempts will fail even if the initial test connection worked. This refresh-token rotation is a common follow-up issue in Xero integrations and is worth highlighting. Check for more details here - https://developer.xero.com/documentation/oauth2/overview

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.