Authentication
Securely authenticate with the Tax Nigeria Partner API using scoped API keys.
Authentication
The Tax Nigeria Partner API uses API keys to authenticate and authorize requests. Every API key is cryptographically signed, assigned granular access scopes, and tied to your organization's subscription credit pool.
Header Formatting
You can authenticate your requests by providing your API key in either the standard HTTP Authorization header or the custom x-api-key header:
Standard Bearer Token (Recommended)
Authorization: Bearer txn_abc123xyz789...Direct Header
x-api-key: txn_abc123xyz789...curl -X GET "https://taxnigeria.ng/api/v1/tax/deadlines?month=6&year=2026" \
-H "Authorization: Bearer txn_abc123xyz789..."API Scopes & Permissions
Each API key must be configured with one or more permissions scopes. If a key attempts to access an endpoint outside its assigned scopes, the request is rejected with HTTP 403 Forbidden.
| Scope | Description | Applicable Endpoints |
|---|---|---|
tax:calculate | Full access to calculate PAYE, CIT, WHT, late filing penalties, and unified calculations. | /api/v1/tax/calculate, /api/v1/tax/paye, /api/v1/tax/cit, /api/v1/tax/wht, /api/v1/tax/penalties |
tax:deadlines | Read statutory deadlines, filing schedules, and grace periods across FIRS and State IRS agencies. | /api/v1/tax/deadlines |
tax:query | Search and query official Nigerian tax acts, legal gazettes, and legal precedents. | /api/v1/tax/query, /api/v1/tax/search |
tax:chat | Stream or receive OpenAI-compatible responses from the Tax Nigeria AI intelligence model. | /api/v1/chat/completions |
Key Lifecycle & Security
Managing Keys in the Workspace
You can create, inspect, and revoke API keys at any time:
- Navigate to Settings in the main sidebar.
- Click on the Developer tab.
- Review your active keys, their assigned scopes, last used timestamps, and total API credits.
- If a key is compromised, click Revoke to immediately invalidate all future requests with that key.
Security Best Practices
[!CAUTION] Never expose API keys in client-side code: Do not include your API keys in React, Vue, Flutter web, or mobile app bundles. Always route requests through your own backend server.
- Store in Environment Variables: In Node.js, store your secret as
TAX_NIGERIA_API_KEYand load it viaprocess.env. - Principle of Least Privilege: Only select the scopes required for your integration (e.g., if you only calculate payroll, only grant
tax:calculate). - Rotate Periodically: Rotate production API keys every 90 days or when engineering team access changes.