TTauracoDocumentation
FREN
The Tauraco siteapp.tauraco.io
Home › Developer portal › FAQ
Document menu← Home
Developer portal
  1. Quick start
  2. Authentication
  3. REST API reference
  4. Webhooks guide
  5. Exports guide
  6. ERP integration guide
  7. Bank integration guide
  8. Tauraco Collateral documentation
  9. MCP documentation
  10. Code samples
  11. Error handling
  12. Sandbox environments
  13. Versions and changelog
  14. FAQ
  15. Developer support
Developers

FAQ

Is the API available today?

Yes, in beta, since 2026-11-05: the public API, the bank API, the OAuth authorization server and the MCP server are online under https://api.tauraco.io. Without a token they answer 401: that is expected. The sandbox, however, is not launched yet. Follow Versions and changelog.

Why api.tauraco.io and not api.tauraco.ai?

api.tauraco.io is the canonical host: it carries the OpenAPI document, the token issuer (https://api.tauraco.io) and the identity of the MCP resource (https://api.tauraco.io/mcp). The mcp.tauraco.io and developers.tauraco.io aliases are online since 2026-11-05, the mcp.tauraco.ai, developers.tauraco.ai and api.tauraco.ai names since 2026-11-06. api.tauraco.ai redirects (308) to api.tauraco.io and the issuer stays https://api.tauraco.io: call api.tauraco.io directly, because many HTTP clients drop the Authorization header when they follow a redirect to another host.

How do I get credentials?

A company administrator (ERP_OWNER or ERP_ADMIN) creates the application in Data & integrations › Connected apps, or authorises your application by its public identifier. For a financial institution, it is a decision-maker of the institution. Tauraco never sends credentials by e-mail.

I lost my application's secret.

It is shown only once and Tauraco only keeps a hash. Rotate the secret from the console: a new secret is shown, the old one stops working immediately.

Can one application serve several companies?

Yes: each company authorises it separately, and each token concerns one company only. Pass tenant to /oauth/token to pick the company when several have authorised it.

Why a 404 on a resource that exists?

A resource of another company, a resource your rights do not let you see and a missing resource give the same answer, so as to reveal nothing. Check the grant's company and your scopes.

Why are amounts strings?

To stay exact: a floating-point number loses cents. Read them with a decimal type (Decimal, BigDecimal, decimal). The number of decimals follows the currency: none in XOF, XAF, GNF and KMF.

Can I receive the same webhook twice?

Yes, delivery is "at least once". Deduplicate on webhook-id, stable across retries and replays.

Can an AI assistant change my data?

No. The MCP server is read-only; its only write creates an export, without changing anything. It acts with the rights of the user who connected it, in the chosen company, and access can be revoked at any time from AI & MCP.

Can a bank accept or refuse financing through the API?

No. The bank API reads requests, asks for additional information and reconciles repayments; decisions remain human actions in the portal.

Are Sage, QuickBooks or SAP connectors available?

Sage, QuickBooks, EBP and Pennylane are planned in file mode ("configuration required"); SAP, Dynamics 365, Oracle, NetSuite, Cegid, Xero, Sage X3 and the Sage APIs (Accounting, Intacct, Active) are not supported. See the ERP integration guide.

Where do I report a security flaw?

To [email protected], without public disclosure before a fix. See Developer support.