Tesorio connects to Zuora in one of two ways. OAuth is recommended — it is more secure, and some Tesorio features require it because they rely on Zuora's Data Query API, which only accepts OAuth.
Step 1: Choose how you will authenticate
OAuth (recommended)
Contact your Tesorio representative to enable OAuth on your account. This has to be done by Tesorio before you enter your credentials — until it is, the connection screen will ask for a username and password rather than a client ID and secret.
API user (legacy)
Still supported. Note that Tesorio features which rely on Zuora's Data Query API will not be available on this method. If you have not already created an API User role, follow the instructions in Zuora's knowledge base: Create an API User.
Permissions for the user role in Zuora
Whichever method you use, the Zuora user needs the permissions shown below. An OAuth client inherits the permissions of the user it is created under, so create it under a user with this access.
Step 2: Create your credentials in Zuora
If you are using OAuth
A Zuora administrator creates the OAuth client:
In Zuora, go to Settings > Administration > Manage Users.
Find the user the client should be created under and confirm their status is Active.
Click the username to open the user's detail page.
At the bottom of that page, create an OAuth client. Give it a specific name, such as "Tesorio Integration", rather than a generic one.
Click Create. Zuora displays the Client ID and Client Secret.
⚠️ Zuora displays the Client Secret only once. Copy both values in full before closing the dialog — if the secret is lost, the client has to be recreated.
Each Zuora tenant needs its own OAuth client, so a sandbox and a production tenant require separate credentials.
If you are using an API user
Follow the Zuora instructions linked in Step 1, and use that user's username and password in Step 4.
Step 3: Check your Invoice Settlement setting
In order to correctly import your Zuora data, we must know whether you have the Invoice Settlement feature enabled in your instance. The easiest way to check this is to navigate to Billing, and check to see if "Credit and Debit Memos" shows as an option under Billing.
If "Credit and Debit Memos" is showing, you have Invoice Settlement enabled. If this option is not showing under Billing, then Invoice Settlement is disabled. You will need to specify this setting when setting up your Zuora integration in Tesorio in the next step.
You can learn more about Zuora's Invoice Settlement feature.
Step 4: Connect in Tesorio
On the Zuora Integration screen in Tesorio, enter your credentials, specify whether Invoice Settlement is enabled, and click Connect. Once connected, your data import will start.
The fields you see depend on how your account is set up:
With OAuth enabled, they read Zuora Client ID and Zuora Client Secret.
Otherwise, they read Zuora Username and Zuora Password.
If you created an OAuth client but the screen still asks for a username and password, OAuth has not been enabled on your account yet — contact your Tesorio representative.
