Under federal law, you can only buy handguns in your state of legal residence, either from a licensed dealer (FFL) or a private individual who resides in the same state.
You can buy from a dealer or person who is out-of-state, IF they ship it to a dealer in your state and you pick it up there (and do all related paperwork, and pay a fee).
For a dealer/FFL handgun purchase or transfer, you must provide ID that shows your residence address (if from out-of-state, or no ID, you will be denied).
California also has state laws restricting the types and models of handguns that can be owned/possessed by residents; if a certain model is not on the "approved" list, new ones cannot be sold by in-state dealers. This may be the problem with the XD-M; check the state "approved" list to be sure.
I believe California also requires sales between in-state private individuals to be documented through a licensed dealer (there is a fee, of course).

Some reading from the BATFE's Frequently Asked Questions list:

ATF Online - Firearms - Frequently Asked Questions - Unlicensed Persons

ATF Online - Firearms - Frequently Asked Questions

ATF Online - Firearms - Frequently Asked Questions - Unlicensed Persons

Record-keeping requirements (see note):
ATF Online - Firearms - Frequently Asked Questions - Unlicensed Persons