Reseller accounts

The OAuth API on the rest of this site is for partners: software providers and integrators who send invoices for the companies they work with. Reselling is something else, with its own endpoints and its own dashboard — and there are two ways to have it.

Everywhere else on this site, an OAuth app acts for a person who holds a role on companies, and reaches those companies' entities, users and invoices — see Roles and permissions. A reseller account's app does not. It reaches the reseller's own list of clients and their counts, and never an entity, a user or an invoice — not even of a client it brought in. An app of an existing account with reseller access keeps everything its owner's roles give it, and reaches the reseller's clients too.

Which kind applies comes from the account, not from anything you choose when creating the app, and it is read on every call — so it cannot be lost or worked around by creating another app.

Request reseller access

With reseller access on an existing account, the two passwords are kept apart on purpose: signing in or out of one never signs you in or out of the other, and too many wrong attempts at one never locks the other. If you lose the reseller password, Tax Star sets a new one; your E-Invoice password is not affected.

That is all reselling does. It never lets you create companies, send or read a client's invoices, or manage its users, and you see only the clients you submitted yourself — never another reseller's. A TRN that is already registered when you submit it is refused with 409 entity_exists: you are linked only to a company registered after your request.

For a reseller account's app, everything marked No answers 403 insufficient_scope, whatever the method, before any work is done and without counting against the rate limit:

{
  "error": "insufficient_scope",
  "error_description": "This application belongs to a reseller account. It can call the reseller endpoints (/einv/oauth/reseller/*) and GET /einv/oauth/me only."
}

For an app of an existing account with reseller access, the rest of the API answers exactly as it does for any app — by its owner's role on each company. The reseller endpoints share the same rate limits as the rest of the API, counted per app, and the same token lifetimes.

A reseller account's app has no entities and no webhooks, so Your apps shows a note in their place, and the webhooks manager does not list the app. With reseller access on an existing account, the portal is unchanged: your apps keep their entities, webhooks and charts.

The counts are the same ones the Tax Star admin panel shows for that company, so everyone reading them sees the same number. They are counts only: no invoice, amount, buyer or document is returned. A client whose entity is later deleted reads activity: null again.

totals on the list covers every client you have submitted, not only the current page, and counts each company once even if two of your submissions — its 15-digit TRN and its 10-digit TIN — turned out to be the same company.

{
  "clients": [
    {
      "id": "6710c0ffee0000000000abcd",
      "trn": "100000000000003",
      "email": "client@example.com",
      "company_name": "Client LLC",
      "notes": "",
      "status": "entity_created",
      "created_at": "2026-10-01T09:00:00+00:00",
      "entity_created_at": "2026-10-03T12:30:00+00:00",
      "activity": { "sent": 42, "received": 17, "failed": 2 }
    }
  ],
  "total": 1,
  "page": 1,
  "limit": 25,
  "total_pages": 1,
  "totals": {
    "clients": 1,
    "pending": 0,
    "entity_created": 1,
    "activity": { "sent": 42, "received": 17, "failed": 2 }
  }
}

Tax Star can switch reseller access off from the admin panel, for either kind. From the next request the reseller endpoints answer 403 reseller_inactive and the Reseller dashboard closes. Switching it back on restores both at once, with the same apps and credentials.

A reseller account's app does not fall back to the full API: every other endpoint still answers 403 insufficient_scope. An existing account loses only the reseller side — its companies, its E-Invoice sign-in and the rest of its apps' API are untouched.

The endpoints are on Reseller clients. Account types and company roles are on Roles and permissions. Creating an app is on Create an app, managing it on Your apps, and tokens on Authentication.