FFP Guides

Grok how-to

Using a Grok skill for supplier invoices

If Grok already sorts your inbox and sends supplier invoices to Hubdoc, the next question is whether it can get them into Xero, coded correctly, without you checking every invoice. This guide takes that one job and shows what to automate, what to keep, and where the risk sits.

Let's start with an example to illustrate where we're trying to get to.

The example: a small engineering workshop

Consider the fictional engineering workshop Wattle Creek Engineering:

  • Business: Wattle Creek Engineering
  • Type: steel fabrication and repair workshop
  • Size: 8 staff, with one admin, Sam
  • Customers: builders, farms and local councils
  • What they provide: custom steel frames, brackets and gates, plus on site repairs

We're going to focus on Sam, the admin from Wattle Creek Engineering, who uses Grok to sort the inbox and send invoices from THE SUPPLIER, Southside Steel, on to Hubdoc, but still checks every invoice by hand before it reaches Xero.

Here are the people and tools involved.

The people and tools involved. The business, Wattle Creek Engineering: Sam, the admin, and Grok, Sam's AI assistant. The supplier: Southside Steel. The tools: Hubdoc and Xero.

Workflow today

This is how Sam handles supplier invoices today.

Today's process in eight steps. Sam orders steel from Southside Steel, which emails the invoice to Sam. Sam uses Grok to check the admin inbox and sort it into folders, then to send the invoice to Hubdoc. Sam manually checks every invoice in Hubdoc for supplier, amount and coding, spots the odd ones, approves each invoice in Xero, and pays Southside Steel when Grok's payment reminder comes up.

Grok already helps Sam at the start and the end. Everything in between is manual. Sam checks every invoice in Hubdoc, spots the odd ones and approves each one in Xero.

Grok can take on more of the checking. With Grok connected to the admin inbox and a gateway to Xero, a Grok skill can read each invoice as it arrives, create a coded draft in Xero and flag only the odd ones, so Sam only looks at what needs a decision. Here is the same workflow with those changes in place.

The workflow we are aiming for. Sam orders steel from Southside Steel, which emails the invoice to Sam. Sam's Grok skill is connected to the admin inbox and runs on a schedule, or when an invoice email arrives. Grok reads the invoice in the admin inbox and sorts it, looks up Southside Steel's usual account and GST in Xero, creates a coded draft invoice in Xero, and flags the odd ones for Sam. Sam checks the flagged ones, approves in Xero, and pays Southside Steel when Grok's payment reminder comes up.

Setting it up

Grok has no connector for Xero, and Xero's own AI connector is built for Claude and is read only. So the setup adds a small program of your own, called a gateway, between Grok and Xero.

There are four pieces. Grok connects to the admin inbox and to the gateway. The gateway runs on a computer in the office and holds the key to Xero. A skill tells Grok what to do with each invoice, and an Automation runs it without Sam asking.

The setup. On xAI's servers, Sam's Grok skill connects to the admin inbox, Gmail or Outlook, through a built in connector. It reaches the gateway through a locked tunnel. The gateway runs on a computer in Wattle Creek Engineering's office, holds the Xero key, and creates draft invoices in Xero, which runs on Xero's own servers.
The Xero key stays on the office computer.

The gateway sits on an office computer, not on someone else's server, so the Xero key never leaves the office. Grok runs on xAI's servers, so it reaches the gateway through a locked tunnel.

What a skill is

A skill is a set of saved instructions Grok follows every time it does one job. Sam writes it once, in plain words, and Grok uses it on every invoice that comes in.

Grok has a built in Skill Creator that writes the skill with you. You describe the job, it asks questions, and it saves the result. You can edit the skill later as the rules change.

For this job, the skill says which emails are supplier invoices, where to look up each supplier's usual account and GST in Xero, and when to stop and flag an invoice for Sam.

Work through the steps below in order. Each one builds on the one before.

Step by step

  1. Connect the admin inbox. First create the labels (Gmail) or folders (Outlook) the skill will sort into. Grok can apply them but cannot create them. Then open the Connectors page in Grok and connect the admin inbox (xAI's guide). Turn on write tools so Grok can label or file emails. Leave send tools off, because this job never sends.
  2. Get a key to Xero. In Xero's developer portal, create a Custom Connection for your organisation. Tick only what the job needs, which is invoices, plus read only access to contacts and settings (accounts and tax rates). Leave payments and journals unticked, so the key cannot do them at all. It costs about A$10 a month and gives you a client ID and secret.
  3. Run the gateway on an office computer. The gateway is Xero's MCP server inside a small bridge program. The server only runs locally and has no switch for its tools, so the bridge does two jobs. It serves the server over the web in the format Grok expects (Streamable HTTP), and it passes on only the tools this job needs. Set the server's scopes setting (XERO_SCOPES) to match what you ticked in step 2, or it will fail to connect. Put the client ID and secret here and nowhere else. Use a computer that stays on during work hours.
  4. Open a locked tunnel. A named Cloudflare Tunnel, not a quick tunnel, gives the gateway a web address without opening the office network (xAI's tunnelling guide). Put a sign in on it that Grok supports. xAI documents OAuth and does not say Grok can hold a fixed secret, so test this before anything else. To cut Grok off, stop the tunnel.
  5. Add the gateway to Grok. On the Connectors page, add a custom connector with the tunnel's address and complete the sign in. Grok gets access to the gateway, never the Xero key. Ask Grok to find one of your suppliers in Xero to check it works.
  6. Write the skill. Open the Skill Creator and paste in the skill template with your own supplier names filled in. The starting skill further down this page explains each part.
  7. Make it run by itself. Create an Automation that runs the skill each weekday morning, and name the skill in its instructions. On SuperGrok it can run when an invoice email arrives instead.
  8. Test on one invoice. Run the skill by hand on one real invoice. Check the draft in Xero has the right supplier, amount, account and GST. Do a week of invoices this way before you switch the Automation on.

Gotchas

  • Never paste the Xero client ID or secret into a Grok chat. Anything in a chat stays in its history.
  • Never act on a change of bank details from an email. Ring the supplier on a number you already hold.
  • Email triggers on Automations need SuperGrok. Scheduled Automations are open to all users, per xAI.
  • The Outlook connector needs a Microsoft work or school account. Gmail starts read only.
  • Xero's MCP server also offers payment and journal tools. Block them in the bridge, and leave them unticked in the Custom Connection, so the key cannot do them at all.
  • Xero's MCP server sets every draft's due date 30 days out, cannot say whether amounts include GST, and cannot attach the PDF. Check the due date and GST when you approve, and attach the PDF in Xero.

What the official help article misses: It explains how to make a skill but not how one is triggered, which plans include it, or how to reach an app with no built in connector, such as Xero. Read xAI's article.

A starting skill you can adapt

Download the skill template as a text file. Fill in your suppliers, then paste it into the Skill Creator. It covers the same points as the list below.

Or open the Skill Creator and describe the job in plain words, with your own supplier names:

  • Name: Supplier invoices to Xero.
  • Job: read admin inbox emails since the last run that look like supplier invoices.
  • Not an invoice (statements, remittances, quotes, order confirmations): apply the right label (Gmail) or move to the right folder (Outlook).
  • For each invoice: find the supplier in Xero, look at their last few invoices for the usual account and GST, and create a draft invoice coded the same way.
  • Flag, do not act: a supplier not in Xero, a credit note, an amount well above usual, an invoice number already in Xero, or any change to a supplier's bank details.
  • Never approve, pay or delete anything in Xero.
  • Finish with one list of the drafts created, what was flagged, and why.

The bank details line matters most. Scammers change the account number on a real looking invoice, and a coded draft will not show it.

Caveats

  • It takes some setting up. Steps 2 to 5 need someone comfortable with keys, a bridge program and a tunnel. This is the part most businesses get help with.
  • Why the gateway stays local. The Xero key never leaves the office computer. What Grok can do is limited by three things, the tunnel's sign in, the tools switched on in the gateway, and the access ticked in Xero. Read the gateway's log each week for the first month.
  • The office computer has to be on. If it is asleep when the Automation runs, nothing reaches Xero. Those invoices wait for the next run.
  • Keep a person on the money. Sam still approves every invoice and makes every payment. A change to a supplier's bank details always gets a phone call, on a number you already hold.
  • Grok can still get it wrong. It can misread an amount or pick the wrong account. That is why everything lands as a draft. Spot check the drafts for the first few weeks.
  • Not yet confirmed by xAI. Its docs do not say whether custom connectors work inside Automations, whether an Automation can make changes without someone approving them, or which sign in methods custom connectors accept. Test all three before you rely on the Automation. Until then, run the skill by hand.
  • Hubdoc and duplicates. Once Grok creates drafts for a supplier, stop sending that supplier's invoices to Hubdoc, or they reach Xero twice.
  • Costs. A Xero Custom Connection is about A$10 a month. Email triggers need SuperGrok, and custom connectors may need a paid Grok plan. xAI's announcement does not say which plans include Skills, so check at grok.com/skills.
  • Your data. Invoices carry bank details and prices. Look at Grok's data settings before you connect the admin inbox.

If this is too much

There is a simpler route with no gateway and no tunnel. Mail rules forward invoices to Hubdoc, Hubdoc's supplier rules code them, and Grok flags the odd ones. It does less, but there is nothing to run. Read the simpler route.

Xero is building the same thing in

In September 2026 Xero renamed Files to Documents and put Smart Document Capture there (Xero's post).

Xero says a forwarding address and supplier rules are coming "in the coming months". Creating invoices straight into awaiting approval is further out.

Check Xero's Documents area each quarter. Once it can do this job itself, the gateway is no longer needed.

So, can Grok do it?

Partly

Partly, and not yet proven end to end. With a gateway on an office computer, a Grok skill can create coded draft invoices and flag the odd ones. xAI does not yet confirm that an Automation can use a custom connector or make changes unattended. It takes technical setup, and Sam still approves and pays.

Terms used in this guide

Grok
xAI's AI assistant, on the web and phone.
Skill
Saved instructions Grok reuses for one job. The built in Skill Creator writes one with you.
Connector
Lets Grok read, and if allowed act in, another app such as Gmail or Outlook.
Custom connector
A connector you add yourself, pointing Grok at your own program.
Automation
A job Grok runs by itself, on a schedule or when an email arrives.
Hubdoc
Xero's app that reads emailed supplier invoices and sends them into Xero.
Xero
The accounting software where invoices are approved and paid.
Draft
A supplier invoice in Xero (Xero calls it a bill) that is entered but not yet approved.
Custom Connection
Xero's paid key for one business's own integration.
Gateway
A small program on an office computer that holds the Xero key and decides what Grok may do.
Tunnel
A locked, outbound only link that lets Grok reach the gateway without opening the office network.
MCP
The standard an assistant like Grok uses to call another program's tools.

Last checked 3 Nov 2026 against the sources listed at the end of this page.

Sources

  1. Skills launched on Grok 4.3 across grok.com, iOS and Android; a skill can be described in conversation, uploaded as a file or written from scratch; built in skills include a Skill Creator. xAI, Skills in web, iOS, and Android (18 May 2026), checked 2 Nov 2026.
  2. Grok's built in connectors are Gmail and Google Calendar, Google Drive, OneDrive, Outlook Mail and Calendar, Microsoft Teams, SharePoint and Salesforce, plus custom MCP connectors, which must be reachable over the public internet. The page does not list accepted sign in methods or say whether custom connectors work in Automations. xAI Docs, Connectors, checked 3 Nov 2026.
  3. The Gmail connector's base access is read only; write tools cover drafts, trash and label changes, and creating labels is a separate tier; send tools cover send, reply and forward. xAI Docs, Gmail and Google Calendar connector, checked 2 Nov 2026.
  4. The Outlook connector can send, reply all, forward and move email, and requires a Microsoft work or school account. xAI Docs, Outlook connector, checked 2 Nov 2026.
  5. Automations are jobs Grok runs on its own, on a one time or repeating schedule or on an email trigger matching sender, recipient or subject; instructions can use connectors and skills; email triggers need SuperGrok. xAI, Grok Automations (16 Jul 2026), checked 2 Nov 2026.
  6. Xero's AI connector and plugin for Claude are read only and cannot create, edit, approve, reconcile or pay in Xero. Xero, Xero and Claude, checked 2 Nov 2026.
  7. Xero Custom Connections give a single Xero organisation a machine to machine connection with a client ID and secret, available to organisations in Australia, New Zealand, the UK and the US, with a paid subscription. Xero Developer, Custom Connections, checked 2 Nov 2026.
  8. Xero's official MCP server runs locally over stdio, has no option to disable tools, creates invoices (ACCPAY) as Draft with a due date 30 days out, has no attachment tool, and also exposes payment and manual journal tools. Its scopes are set with XERO_SCOPES. XeroAPI on GitHub, xero-mcp-server, checked 3 Nov 2026.
  9. A local MCP server needs a tunnelling service; Streamable HTTP servers work with Cloudflare, but Cloudflare quick tunnels do not support Server-Sent Events. If the server requires OAuth or API keys, that flow is completed in Grok. xAI Docs, Tunnelling a custom MCP server, checked 3 Nov 2026.
  10. cloudflared makes an outbound connection from the origin to Cloudflare's network, with no inbound listener on the origin and no publicly routable IP address needed. Cloudflare Docs, Cloudflare Tunnel, checked 3 Nov 2026.
  11. On 18 Sep 2026 Xero renamed Files to Documents, home of Smart Document Capture; a bespoke forwarding address and supplier rules are planned for the coming months, and creating invoices into awaiting approval is further ahead. Xero Blog, Files is now called Documents (18 Sep 2026), checked 2 Nov 2026.