This section describes how to solve common problems associated with authentication.

Identifying a firewall or proxy server problem

If your software is unable to contact AvaTax, most API calls you make will produce an error. So, let’s begin by explaining how we can identify whether a connection problem exists.

First, visit the AvaTax API server from your desktop computer or mobile phone. Try both of these two URLs, one for Sandbox and one for Production:

Sandbox Environment: https://sandbox-rest.avatax.com

Production Environment: https://rest.avatax.com

If your connection is working correctly, you’ll see a page similar to the following:

A screenshot showing the rest.avatax.com site with links to AvaTax resources.

If you can’t see this page on your desktop computer at work, but you can see this page from a mobile phone on the public internet, you likely have a networking issue. There’s a chance that your office has a firewall or proxy server that enforces some limits on your network connectivity. Contact your corporate IT department for more information.

Other common problems

PROBLEM TYPE	STEPS TO DIAGNOSE
Routing Problems	Do your routers have the latest software? Have they been rebooted recently, or are there too many hops between your network and the outside world? If your network is using a direct connection with a local internet service provider, does your connection reset regularly? If the connection is permanent or business-class, does your ISP offer metrics to help you measure response time? If you have a more advanced network using Border Gateway Protocol routing, you will need to talk to your network engineering team. BGP issues are very challenging to review and are beyond the scope of this article. Due to security issues, Avalara's servers don't respond to ping requests. This means that network traces from software like traceroute or tracert aren’t able to provide accurate route timings.
Authentication Problems	Try using the Ping API, or switch to using an AvaTax SDK, which has prebuilt and tested authentication code.
Firewall Problems	To use AvaTax, you must enable access to all IP addresses identified by these DNS names: Sandbox environment: https://sandbox-rest.avatax.com Production environment: https://rest.avatax.com AvaTax is a dynamic product, and its IP addresses may change regularly. AvaTax doesn’t support firewalls that filter on individual IP addresses.
Ethernet Problems	Check the quality of your wiring and the auto negotiate settings on your Ethernet devices. Bad wiring or devices with mismatched speed settings are easy to overlook! You can run `netstat -s` on a windows machine or `ifconfig -a` on a Linux machine to detect whether an unusual number of bad packets are coming through your network. If you have a performance mismatch, try checking with your network administrator to see if the cabling can be improved.
Host Files / IP Address Hardcoding / DNS Caching	AvaTax doesn’t support hardcoded IP addresses or host files. To use AvaTax, you must resolve DNS names dynamically. Your DNS server should respect the DNS time-to-live (TTL) values; Avalara publishes DNS TTL values designed to permit our operations team to adjust our connectivity in response to changing network conditions.
Proxy Server Problems	AvaTax isn’t designed for environments using proxy servers. Proxy servers can cause latency and connectivity problems when calling high performance APIs like AvaTax. If your company policy requires a proxy server, consult your proxy provider for how to configure correctly the proxy to work with AvaTax.
DNS Time-To-Live	Avalara makes changes to our domain name system records periodically. Ensure that your software respects the DNS time-to-live values and that your software periodically contacts DNS to update its name lookups. Some software applications, including some Java JRE versions, may need to be updated to ensure they handle the "ttl" or "time-to-live" values correctly. If you experience problems with occasional DNS changes, check the documentation for your operating system, programming language, or development environment to ensure your software handles TTL values correctly.
Need SSL Certificate Verification	Some web clients (such as cURL for Windows) will require you to download the Avalara AvaTax SSL public keychain and install it into your client’s keychain repository. If the client program requests that you specifically accept and trust Avalara's web certificate, here's how to proceed: Go to VeriSign Root CA; and follow the instructions. Save the file in your preferred directory, for example, certs-ca-bundle.crt. Register that file following your standard certificate store process.

Troubleshooting