SureTax Config API

API Authentication

The SureTax Config API supports the following forms of authentication

OAuth

OAuth 2.0

OAuth (Open Authorization) is an open standard for access delegation. It allows users to grant third-party applications limited access to their resources without sharing their credentials. OAuth is commonly used for token-based authentication. Follow the steps below to configure OAuth 2.0

Step 1: Client Registration

To use the API, Wolters Kluwer and the SureTax Solution Team will need to register your application.

What You Need to Provide

• Application Name
• Application Description
• Redirect URL

What You Will Receive

After registration, you will receive your Client Credentials: a Client ID and a Client Secret.

Next

Step 2: Obtain Authorization from the Resource Owner

Having received your **Credentials** , it is now time to obtain authorization to the SureTax API Gateway.

What You Need to Do

• Redirect the User: Direct the user to the authorization server's authorization endpoint, sending in the Client ID, requested Scopes, and Redirect URI that you received in the previous step.

• Handle the Redirect: After the user grants permission, handle the redirect from the authorization server, which includes an Authorization Code.

BackNext

Step 3: Exchange Authorization Code for Access Token

In this step, the customer's application will exchange the authorization code for an access token.

What the Customer Needs to Do:

• Token Request: Make a POST request to your token endpoint. Include the following parameters in the request body:
  • authorization_code: The authorization code received from the authorization server.
  • client_id: Your application's client ID.
  • client_secret: Your application's client secret.
  • redirect_uri: The URI where the authorization code was sent.

What to Expect from Your API:

• Response: Upon successful exchange, your API will return a JSON response containing:
  • access_token: The token used to authenticate API requests.
  • token_type: The type of the token, usually "Bearer".
  • expires_in: The lifetime of the access token in seconds.
  • refresh_token: A token used to obtain a new access token when the current one expires.
  • scope: The scopes granted by the access token.

Example of a Response:

{
  "access_token": "ACCESS_TOKEN_HERE",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "REFRESH_TOKEN_HERE",
  "scope": "requested_scopes"
}

BackNext

Step 4: Access Protected Resources

The customer’s application uses the access token to access protected resources.

What the Customer Needs to Do:

• API Request: Include the access token in the Authorization header of API requests to your protected resources.

BackNext