Get started
Authentication
Every request carries a credential. The REST API takes an API key; the MCP connector takes an API key or an OAuth sign-in.
API keys
Create keys in the dashboard under Developers → API keys. A key belongs to one organization and carries a set of scopes. Live keys start with tflo_live_; test keys start with tflo_test_. Treat a key like a password and keep it on your server.
REST requests send the key in the X-API-Key header:
curl "https://api.tarifflo.com/api/v1/tariff-rates/JOB_ID" \
-H "X-API-Key: tflo_live_..."The MCP connector also accepts the key as a Bearer token, which suits clients that can only set Authorization:
Authorization: Bearer tflo_live_...OAuth (MCP only)
Claude, ChatGPT and other web MCP clients connect without a key. When the client calls the connector with no credential, it receives an OAuth challenge, opens a Tarifflo sign-in page, and receives an access token for the organization you pick. Tokens last one hour and refresh automatically. See MCP connector.
Scopes
A key must carry the scope an endpoint requires, or the request returns 403.
| Scope | Grants |
|---|---|
classifications | POST/GET /api/v1/classifications and /api/v1/classifications/batch |
tariff_rates | POST/GET /api/v1/tariff-rates |
audit | /api/v1/audit uploads and runs |
eccn | POST/GET /api/v1/export-control |
origin | POST/GET /api/v1/origin |
entries:write | POST /api/v1/entries |
filing | The filing, sorting, configuration and entry-editing tools of the MCP connector |