Skip to main content

Solutions

Law firms

Tax, audit & accounting firms

Corporations

Governments

Products

Legal

Trade & supply

Tax, audit & accounting

Corporate tax

Risk & fraud

Books

Recommended products

Questions? We are here to help.
Contact us

Purchase

Buy solutions

Buy books

Contact sales

Questions? We are here to help.

Resources

Insights

Events

Product training

Product communities

Developers

2025

January 2025 release notes

Release notes explain new features and improvements made to ONESOURCE API Administration.

What's new

Refresh token

We’ve enhanced our token generation where you can use
Refresh Tokens
 to generate a new
Access Token
.
Refresh Tokens
 reduce security risks by letting you use a separate refresh token instead of supplying client credentials each time.
You can use refresh tokens to generate
Access Tokens
 by making slight modifications to the existing request and response payload of the token generation endpoint,
oauth2/v1/token
. If the authorization server provides a refresh token to you, you can make a refresh request to the token endpoint.
Add the following parameters using the "application/x-www-form-urlencoded" format per Appendix B. Make sure you use a character encoding of UTF-8 in the HTTP request entity-body:
  • grant_type
    • Required. Select
      refresh_token
       as the grant type.
  • refresh_token
    • Required. Provide the refresh token issued to you.
The authorization server revokes the old refresh token after issuing a new one. The refresh token is valid for 24 hours.
Example of a token request:
Example of the token code:
Authorization code:
curl --location 'https://api-cloud-dev2.onesourcetax.com/oauth2/v1/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: LSLanguage=en-US' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'authcode= auUVB4Bb' \
--data-urlencode 'refresh_token= BOzu3ValnVOefCDTDeJsUfz8vafe4hSZ9YHCmiEz'
note
  • An individual refresh token is valid for 24 hours. Use it within this time to avoid needing to request a new access token using the original method.
  • The scopes remain the same. Omit them in subsequent calls using the refresh token grant type.
  • You can use a refresh token once to generate a new access token. Then, use the new refresh token from the response.
  • Refresh tokens are typically long-lasting credentials used to request additional access tokens. They link specifically to the client who receives them. If your client type is confidential or has credentials (or other authentication requirements), authenticate with the authorization server.

Basic authorization token

Use Custom Authorization
We currently support 3 different ways of authorization on the
Add Webhook Registration
 screen:
  • Thomson Reuters signed JWT Bearer token
    This is the default option. With every call to your callback, we generate a JWT token and sign it with a special certificate. You can validate the token signature using the provided public key (which you can download from a special URL or copy from ONESOURCE Events).
  • Oauth2 Credentials
    You can set up your own identity provider and share the OAuth2 token endpoint and credentials with us. We’ll request an access token and provide it with all calls to your callback endpoint. We'll cache the access token value depending on its expiration time.
  • Basic Authorization
    This is the simplest and least secure authorization method. You provide a username and password during endpoint setup. We provide these credentials with every call to your callback as an Authorization HTTP Header in the following form:
    Authorization: Basic base64encoded(username: password)

This article applies to:

  • Product: ONESOURCE API Administration