> ## Documentation Index
> Fetch the complete documentation index at: https://docs.taxrock.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> From zero to a successful lookup.

This walks through connecting one user and making your first call. Steps 1–3 acquire an
access token. Step 4 uses it.

> [!NOTE]
>
> The interactive **Run** on the [API reference](https://docs.taxrock.com/delegate-access/api-reference/client-accounts/lookup-by-ein.md)
> pages calls the live endpoints with an access token you paste in. The token itself is
> obtained with the steps below.

## Before you start

* Have your `client_id` and `client_secret` handy (delivered per environment).
* Make sure you have a working sandbox login (in the sandbox handoff document). Sandbox users sign
  in at [demo.taxrock.com](https://demo.taxrock.com).

> [!TIP]
>
> Send us your **callback URL** so we can register it for your application. Until then, the
> steps below use `http://localhost:0000`, which is registered for every application, and you copy
> the code from the browser's address bar.

## 1. Generate a PKCE verifier and challenge

```powershell Windows PowerShell theme={null}
$bytes = New-Object byte[] 32
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
$codeVerifier = [Convert]::ToBase64String($bytes) -replace '\+', '-' -replace '/', '_' -replace '=', ''
$hash = [System.Security.Cryptography.SHA256]::Create().ComputeHash([System.Text.Encoding]::ASCII.GetBytes($codeVerifier))
$codeChallenge = [Convert]::ToBase64String($hash) -replace '\+', '-' -replace '/', '_' -replace '=', ''
Write-Host "challenge: $codeChallenge"
Write-Host "verifier:  $codeVerifier"
```

```bash macOS / Linux theme={null}
code_verifier=$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=')
code_challenge=$(printf "%s" "$code_verifier" | shasum -a 256 -b | awk '{print $1}' | xxd -r -p | base64 | tr '+/' '-_' | tr -d '=')
echo "challenge: $code_challenge"
echo "verifier:  $code_verifier"
```

Keep the **verifier** for step 3.

## 2. Give consent with your sandbox user

Fill in your `client_id` and the `code_challenge` from step 1, then **Copy authorize URL**
and open it in a browser:

client\_id

code\_challenge
(from step 1)

Include `verify:tins` (needed for
[TIN verification](https://docs.taxrock.com/delegate-access/api-reference/tin-match/verify.md))

Planning to use [TIN verification](https://docs.taxrock.com/api-reference/tin-match-results.md)? Tick the
`verify:tins` box so your tokens carry that scope from the start; otherwise you can add
it any time later by re-running authorize with the extra scope.

Log in and consent to the requested scopes. You will be redirected to a fake callback url that
looks something like this:

```
http://localhost:0/?code=OSlQ6j6TO0yugixyCIbxR53HSU6a-Y6BOoZDT8Wo_i9a2&state=A_RANDOM_VALUE
```

For now, just grab the **code** value and save it for step 3. For more information, see the
[Authorize](https://docs.taxrock.com/delegate-access/api-reference/authentication/authorize.md) reference.

## 3. Exchange the code for tokens

Open [Get or refresh a token](https://docs.taxrock.com/delegate-access/api-reference/authentication/token.md), select the
**authorization\_code** example, then fill in these values and **Run** it:

| Parameter | Value |
| - | - |
| `grant_type` | `authorization_code` |
| `client_id` | your client ID |
| `client_secret` | your client secret |
| `code` | the `code` from step 2 |
| `redirect_uri` | `http://localhost:0000` |
| `code_verifier` | the verifier from step 1 |

The response includes an `access_token`. Use it in step 4.

## 4. Make your first call

Open [Look up client account by EIN](https://docs.taxrock.com/delegate-access/api-reference/client-accounts/lookup-by-ein.md) (or
[Look up taxpayer by EIN](https://docs.taxrock.com/delegate-access/api-reference/taxpayers/lookup-by-ein.md)), paste your
`access_token` as the bearer credential, send a sandbox EIN such as `11-1111111`, and
**Run**.

> [!TIP]
>
> Your sandbox is preloaded with test businesses covering each compliance scenario. Your
> handoff document lists their EINs and what each one returns. Look a few up to see the
> different statuses, and see [Lookup results](https://docs.taxrock.com/api-reference/lookup-results.md) for how to
> read the response.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.