diff --git a/app.py b/app.py
index b6f7174..1969f1d 100644
--- a/app.py
+++ b/app.py
@@ -59,8 +59,7 @@ def list_commands():
 def auth_handler(plugin_display_name, auth_name, params):
     auth = PluginService.auth_named(plugin_display_name, auth_name)
     if auth is not None:
-        handler_params = auth.filtered_params(params)
-        app_description = auth(**handler_params).app_description()
+        app_description = auth().app_description(app.config)
 
         # TODO right now this assumes Oauth.
         # would need to expand if other auth providers are used
@@ -89,8 +88,8 @@ def do_auth(plugin_display_name, auth_name):
 
     # TODO factor into handler
     # TODO namespace the keys
-    session["client_id"] = params["client_id"]
-    session["client_secret"] = params["client_secret"]
+    session["client_id"] = app.config["XERO_CLIENT_ID"]
+    session["client_secret"] = app.config["XERO_CLIENT_SECRET"]
 
     oauth_redirect_url = url_for(
         "auth_callback",
diff --git a/connectors/connector-xero/connector_xero/auths/oauth.py b/connectors/connector-xero/connector_xero/auths/oauth.py
index eeac3c4..e898455 100644
--- a/connectors/connector-xero/connector_xero/auths/oauth.py
+++ b/connectors/connector-xero/connector_xero/auths/oauth.py
@@ -4,18 +4,17 @@
 class OAuth:
     """OAuth."""
 
-    def __init__(self, client_id: str, client_secret: str):
+    def __init__(self):
         """__init__."""
-        self.client_id = client_id
-        self.client_secret = client_secret
+        pass
 
-    def app_description(self):
+    def app_description(self, config):
         """App_description."""
         return {
             "name": "xero",
             "version": "2",
-            "client_id": self.client_id,
-            "client_secret": self.client_secret,
+            "client_id": config["XERO_CLIENT_ID"],
+            "client_secret": config["XERO_CLIENT_SECRET"],
             "endpoint_url": "https://api.xero.com/",
             "authorization_url": "https://login.xero.com/identity/connect/authorize",
             "access_token_url": "https://identity.xero.com/connect/token",
@@ -25,6 +24,7 @@ class OAuth:
             "accounting.contacts accounting.attachments assets projects",
         }
 
+    # TODO reconsider how this is working
     @staticmethod
     def filtered_params(params):
         """Filtered_params."""