Tauraco developer portal

Tauraco opens company data to its customers' software, to financial institutions and to AI assistants, with the same controls as the application: every call only sees the company that authorised it, and only the data its scopes cover. This portal describes the public API, OAuth 2.0 authentication, signed webhooks, exports, ERP connectors, the bank API and the MCP server.

Online since 2026-11-05, in beta (1.0.0-beta). The public API, the bank API, the OAuth authorization server, the MCP server and this portal are deployed in production and answer at the addresses below (checked on 2026-11-05). Since 2026-11-06, the dedicated names under tauraco.ai answer as well. The sandbox is still to come. The Versions and changelog page tracks the status of each surface.

Surfaces and addresses

The canonical addresses are under api.tauraco.io; the token issuer and the identity of the MCP resource stay https://api.tauraco.io, whichever alias you use. The mcp.tauraco.io and developers.tauraco.io aliases are online since 2026-11-05, the dedicated mcp.tauraco.ai, developers.tauraco.ai and api.tauraco.ai names since 2026-11-06. api.tauraco.ai is only a 308 redirect to api.tauraco.io (path, method and body kept): for your calls, target https://api.tauraco.io directly, because many HTTP clients drop the Authorization header when they follow a redirect to another host.

Where to start

• Quick start: an application, a token, a first call, in ten minutes.
• Authentication: OAuth 2.0, scopes, revocation.
• REST API reference: conventions, OpenAPI file, Postman collection.
• Webhooks guide: events, Standard Webhooks signature, replay.
• Exports guide: 24 datasets, 8 formats, scheduled exports.
• ERP integration guide: connectors, accounting mapping, synchronisation.
• Bank integration guide: received requests, documents, repayments, reconciliation.
• Tauraco Collateral documentation: read-only security interests and deposits.
• MCP documentation: connect Claude or another MCP client.
• Code samples: cURL, Python, TypeScript, Java, C#.
• Error handling: one stable code per error.
• Sandbox environments, Versions and changelog, FAQ, Developer support.

Common principles

• One application, one grant per company. An application only reaches a company that an administrator of that company has authorised. The company always comes from the grant, never from a parameter or a header.
• Closed scopes. Thirty-one documented scopes; each operation requires its own, on top of the Tauraco application's role checks.
• Immediate revocation. The grant is re-read on every call: a revocation cuts access on the next request, without waiting for the token to expire.
• Exact amounts. Amounts are decimal strings in major units ("1180000" in XOF, "1234.56" in EUR), never floating-point numbers. Dates are ISO 8601 UTC with Z.
• Normalised errors. RFC 9457 (application/problem+json) with a stable code and a request_id.
• Minimisation. Personal data, bank details and internal fields are excluded by default; no amount and no rate in financing events.
• No decision through the API. Offers, declines, disbursements, discharges and releases remain human actions in the Tauraco portal.

Not in version 1

Inventory and accounting writes through the API, the /projects, /contracts and /guarantees resources, the invoice.updated, tender.published and guarantee.status_changed events, MCP writes other than requesting an export, mTLS, DPoP and FAPI. The list and the reasons are in Versions and changelog.