AvaTax configuration window

Element type: Required

Endpoints/models used: QueryCompanies

Your configuration dialog window must allow the user to specify the following configuration/connection information:

Service URL to access the connector (for example, Production or Sandbox)
Sign in with an account number/license key or with username/password

Configuring authentication

When configuring the authentication method, keep in mind that account ID/license key and username/password authentication are similar in practice. So, why would you choose one over the other? Let’s look at the advantages and disadvantages of license key authentication.

Advantages:

License keys have stronger entropy when compared to a username/password, and are harder to attack.
Account ID / license key authentication isn’t user-specific and won’t expire if one user resets their password.
All basic authentication headers are protected by strong SSL encryption during transit to Avalara.

Disadvantages:

Each account has only one license key.
Revoking your license key will cause all API calls with the old license key to fail.
It isn’t possible to identify individual users acting when license key authentication is used.

Usually, use account ID / license key authentication when implementing connectors. As indicated above, your software should have a configuration page or file that allows a customer to enter in their credentials when they set up your connector; then all API calls made through your connector will use these credentials.

Tip

When designing a method for users to authenticate, consider providing a way to mask the password as the user is entering it, along with an option to show the password.