Skip to main content
Open this URL in the user’s browser to start the connect flow. The user logs in to TaxRock and consents. TaxRock redirects to your registered callback with ?code=...&state=.... This is an interactive browser redirect, not a JSON endpoint. Verify the state value does not change, and exchange the returned code at Get or refresh a token. Pick your environment, paste your client_id and code_challenge, then copy the URL:

​
Query parameters

​
string
required
Must be code.
​
string
required
Your client ID for the environment.
​
string
required
Your callback URL, registered with TaxRock.
​
string
required
Space-delimited. Use offline_access read:client-accounts, adding verify:tins if you use TIN verification. The offline_access scope is what yields a refresh token. See Scopes.
​
string
required
https://delegate.api.taxrock.com (the same in both environments).
​
string
required
The PKCE S256 challenge derived from your code_verifier.
​
string
required
Must be S256.
​
string
An opaque value echoed back to your callback. Verify it matches what you sent.
See the Authentication Details reference for more information.