Authenticate your tenant

Every Taxbit API call carries a bearer token issued to your organization. Your backend requests the token with credentials from the Developer Settings page in the Taxbit Dashboard, and the token never touches a browser.

By the end of this page you have a working bearer token requested from your own backend, a refresh strategy that survives expiry, and a clear split between what runs server-side and what the React SDK receives.

Before you begin

• Your client_id and client_secret from the Developer Settings page in the Taxbit Dashboard.
• Your tenant_id from the same page, if one set of credentials covers more than one organization. The API calls an organization a tenant; tenant_id is your Organization ID.
• A server-side environment to hold them. Nothing on this page runs in a browser.

Request a token

Exchange your client credentials at the token endpoint with the client credentials grant, from a server you control. Include tenant_id when one set of credentials covers more than one organization.

curl -X POST https://api.multi1.enterprise.taxbit.com/v1/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=client_credentials" \
  --data-urlencode "client_id=$TAXBIT_CLIENT_ID" \
  --data-urlencode "client_secret=$TAXBIT_CLIENT_SECRET" \
  --data-urlencode "tenant_id=$TAXBIT_TENANT_ID"

A JSON body with the same fields works too.

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6...",
  "token_type": "Bearer",
  "expires_in": 86400
}

❗️

Never ship the client secret to the browser

The React SDK takes a short-lived account owner token (valid for 1 hour) that your backend fetches on the account owner's behalf, not your credentials. If the secret reaches client code, contact your implementation manager immediately to have it rotated.

Use the token

Send it as an Authorization: Bearer header on every request. Tenant-scoped tokens last 24 hours (expires_in: 86400). Cache the token in your service and request a new one before it expires. If a request comes back 401, request a new token and retry once, so clock skew never strands a request.

curl https://api.multi1.enterprise.taxbit.com/v1/filers \
  -H "Authorization: Bearer $TOKEN"

Examples in these guides use $BASE_URL for https://api.multi1.enterprise.taxbit.com and $TOKEN for this access token.

If the request fails

• 400 invalid_request. The body is missing grant_type. It must be present and set to client_credentials, the only supported value.
• 401. The client_id or client_secret is wrong. Copy both again from Developer Settings; a secret that was rotated no longer works.

The Errors page has every error shape, the rate limits, and which calls are safe to retry.

Parameters

Only the fields used in the request above. The full schema is in the API Reference.

Where to go next

Set up your filer, the entity that submits returns. Account owners and accounts cannot be created until your organization has one.