# Inbound | FAQs

Source: https://developer.avalara.com/tax-docs-en/faqs/faqs/

# Inbound FAQs

Below are answers to common questions that users face when integrating TaxDocs.

Can I use my credentials in both Sandbox and Production?

No, the credentials are unique to each environment.

Do we accept XML files and PDFs for NFE, NFSE and CT-e integration?

For integration using email or Docbox you can send XML or PDF files. The PDFs will be integrated post-conference through the capture portal.

How can I obtain my “Client ID”?

You can access your Client ID in two different ways.

-   When you create your Secret token, your client ID is shown.
-   You can also find your client ID in assinatura and infomações da assinatura.   

How does the ERP integration work?

Avalara has a certified standard SAP connector, compatible with ECC and S/4HANA, which captures documents to the ERP using TaxDocs.

What authentication methods are supported?

The authentication method supported is OAuth 2.0 bearer token authentication.

What can you do if your “Secret Token” was exposed?

If your “Secret Token” has been exposed, it is possible to revoke it through the Avara Portal. 

1.  Select the token that will be revoked and click "revogar" to revoke the token. 
2.  Select "confirmar" to confirm the operation. 

What is our API type?

REST API.

What is the certificate template accepted by TaxDocs?

We accept model A1 digital certificates.

What is the difference between the Sandbox and Production environments?

The sandbox environment is available so that the partner has an environment where they can carry out tests and simulate operations at project time, and before go-live. Therefore, there are no technical differences between environments, except for the data source.

What is the sandbox URL?

[https://api-gateway.sandbox.avalarabrasil.com.br/taxdocs/api/v1/](https://api-gateway.sandbox.avalarabrasil.com.br/taxdocs/api/v1/)

What happens if I send the JSON request WITH “disableTokenRefresh” set to “true”?

You will not receive the "refresh\_token" in the response, and it will be necessary to send the credentials again, after the session expires.

What happens if I send the JSON request WITHOUT “disableTokenRefresh”?

You will receive a "refresh\_token" in the response.

What should I do if I lose my “Secret Token”?

If you did not save your “Secret Token” in a safe place and lost it, you must revoke your token and create a new one. 

Where can I find the methods and objects to access the API?

The content available is published on the portal [https://api-gateway.avalarabrasil.com.br/taxdocs/swagger/index.html](https://api-gateway.avalarabrasil.com.br/taxdocs/swagger/index.html)

[Previous](/tax-docs-en/functional_review/whats_next)