Gas-XeroPrivateApp.js

//http://kjur.github.io/jsrsasign/
function xeroTest() {
  
  var oauth_nonce = createGuid();
  var oauth_timestamp = (new Date().valueOf()/1000).toFixed(0);
  var CONSUMER_KEY = ''
  var PEM_KEY = '-----BEGIN RSA PRIVATE KEY-----' +
'MIICXwIBAAKBgQDPB7KunxwnwTAv5nBGNkUC1Di6ff04tvduhXnYUeYVfX63eepd' +
'...' +
'4JUWEB4JN4hH4wl6GJWviWknMOOSCic4IihFUGzJobDbA9w=' +
'-----END RSA PRIVATE KEY-----'

  var URL = 'https://api.xero.com/api.xro/2.0/Organisation'
  var signatureBase = "GET" + "&"
      + encodeURIComponent(URL) + "&"
      + encodeURIComponent("oauth_consumer_key=" + CONSUMER_KEY + 
                           "&oauth_nonce=" + oauth_nonce + "&oauth_signature_method=RSA-SHA1&oauth_timestamp=" + 
                           oauth_timestamp + "&oauth_token=" + CONSUMER_KEY + "&oauth_version=1.0");
  
  var rsa = new RSAKey();
  rsa.readPrivateKeyFromPEMString(PEM_KEY);
  var hashAlg = "sha1";
  var hSig = rsa.signString(signatureBase, hashAlg);
  
  var oauth_signature = encodeURIComponent(hextob64(hSig));
  
  var authHeader = "OAuth oauth_token=\"" + CONSUMER_KEY + "\",oauth_nonce=\"" + oauth_nonce +
    "\",oauth_consumer_key=\"" + CONSUMER_KEY + "\",oauth_signature_method=\"RSA-SHA1\",oauth_timestamp=\"" +
      oauth_timestamp + "\",oauth_version=\"1.0\",oauth_signature=\"" + oauth_signature + "\"";
  var headers = { "Authorization": authHeader };
  var options = { "headers": headers };
  
  Logger.log(signatureBase);
  Logger.log(oauth_signature);
  Logger.log(authHeader);

  var response = UrlFetchApp.fetch(URL, options);
  var responseXml = response.getContentText();
  Logger.log(responseXml);
}

function createGuid() {
  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
    var r = Math.random()*16|0, v = c == 'x' ? r : (r&0x3|0x8);
    return v.toString(16)
      });
}