AvaTax Brazil Authentication

At this session, you will see all the necessary steps to take to create a token and how to authenticate it in our API.

The Authentication works by the OAuth 2.0 method, which means that an access token will be received to allow access to the application for each call with the credentials obtained.

This “Access Token” has a specific period, and it is necessary to send the credentials again to obtain new access, once it expires.

Advice: It is possible to renew the "Access Token" or to send the credentials on each new call, but the second way is usually only indicated in cases of insecure environment, like GUIs.

STEP 1: Create an API access token through the Avalara Portal:

TASK	RESULT
The entire process for creating the token and the credentials required to access an access token are made through the Avalara Portal. Access the portal at the following URL: https://portal.sandbox.avalarabrasil.com.br/Login	`Access to Avalara portal https://portal.sandbox.avalarabrasil.com.br/Login`
Click`configurações` (configuration), and then click`tokens de assinatura` (signature tokens).	A message displays showing `+ novo token de assinatura` (new signature token).
Select the`+ novo token de assinatura` (new signature token) option.	A basic info box (`informações básicas`) for the Signature token opens.
Generate a new token: Choose a name in the name field (`nome`). Select a start date in the start date field`(Data início DD/MM/YYYY)`. Select an end date in the end date field`(Data fim DD/MM/YYYY)`. Press Save.	`Generates a new token!`
A new window opens with the token information`(informações do token)`. On the signature field `(assinatura)`, the value that should be sent in the tag "`client_id`" appears. On the secret token field `(segredo do token)`, the value that should be sent in the tag "`client_secret`" appears Attention: Ensure that you save the token in a safe place before you conclude the process. It won't be possible to retrieve it again. Press the "yes, I've saved the token secret in a safe place" `(sim, guardei o segredo do token em segurança)` button. Click (`fechar`) to close.	`The signature and token secret values are shown`

Advice: Following best practices, we recommend that each application connecting to our solution uses a separate Access Token.

STEP 2: Getting an access token

Now that you created the necessary credentials inside our Portal, you just need to call our API to get an access token.

Request Model:

POST: https://api-gateway.sandbox.avalarabrasil.com.br/oauth/token

{
  "grant_type": "client_credentials",
  "client_id":"{{client_id}}",
  "client_secret": "{{client_secret}}",
  "disableTokenRefresh": false
}

Advice: This process must be repeated until the session expires. This expiration information can be verified in the body's response tag named: "expires_in_session", and once it expires, you must start the process from the beginning.

Refresh token

As mentioned, when"disableTokenRefresh"=false, the value of the "refresh_token" received in the return of the initial request must be stored in order to later use this stored value for a new request for a signature token, without the need to send the credentials again.

Below is an example of how to send the sessionrefresh_token:

POST: https://api-gateway.sandbox.avalarabrasil.com.br/oauth/token

{
  "grant_type": "refresh_token",
  "refresh_token": "{{refresh_token}}",
}

Previous

Next