Authentication
The API uses two layers of authentication.
Developer login — manage applications
Sign in to create and manage applications. Endpoints under Applications require a Bearer JWT from a developer sign-in. Use the Sign in button at the top right — the portal stores the token and attaches it automatically when you test those endpoints.
Every sign-in has two steps. /auth/sign-in checks the password and returns a short-lived challenge_token, not a session. The JWT is issued only by /auth/2fa/challenge/verify, once the one-time code checks out. That code is emailed by default, or comes from an authenticator app if you set one up under Profile → Security in the E-Invoice app. No account yet? Contact support@taxstar.app.
Access tokens — call the API
Your application exchanges its client_id and client_secret at the token endpoint for a short-lived access token, sent as a Bearer header on every resource request.
Authorization: Bearer <access_token>Tip: run POST /oauth/token in its “Try it” console — the returned access token is captured automatically and reused for the resource and invoice endpoints.