> ## Documentation Index > Fetch the complete documentation index at: https://developer.sandbox.co.in/llms.txt > Use this file to discover all available pages before exploring further. # Authenticate a TRACES deductor > Authenticate a deductor with a TAN and TRACES password to obtain access and refresh tokens for TDS challan and bulk PAN verification requests. This endpoint uses your Sandbox access token in the `Authorization` header. See the [Quickstart guide](https://developer.sandbox.co.in/guides/get-started/quickstart.md) for Sandbox authentication. Pass the returned `data.access_token` as the value of the `Authorization` header for [TDS challan requests](https://developer.sandbox.co.in/recipes/tds/challans/check-tds-challans.md) and [bulk PAN verification requests](https://developer.sandbox.co.in/recipes/tds/pan-verification/verify-pans-with-deductor-token.md). When the deductor access token expires, use [Refresh a TRACES deductor session](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/refresh.md). ## OpenAPI ````yaml api-reference/tds/compliance/openapi.json POST /tds/traces/deductors/authenticate openapi: 3.1.0 info: title: compliance description: >- Tax Deducted at Source (TDS) is an indirect method of collecting Income Tax. TDS is based on the principle of “Pay as you earn” which is beneficial for both the Government and the taxpayer. It is where a person making a payment of specified nature is liable to deduct tax at a prescribed rate. This ensures continuous revenue for the Government by way of Tax Deducted at the Source. The Payer making a payment is also responsible to deposit TDS with the Income Tax Department within a specified date and file a TDS Return. Once filed, the deposited amount will be shown in the Payee's Form 26AS which they can then use to claim tax credits when filing ITR. However, staying TDS compliant can be a hassle for businesses, as they are required to : 1. Deduct TDS from payments that are liable for TDS Deduction at an appropriate rate. 2. Deposit TDS to Government before the due date. 3. File TDS Returns on a Quarterly basis. 4. Issue a TDS Certificate by the deductor to the deductee. Organizations deducting TDS have to remain compliant with each of the steps. Failure to do so results in TDS Penalties by Authorities. Sandbox provides TDS Compliance APIs to help you automate end-to-end TDS compliance. version: 1.0.0 servers: - url: https://test-api.sandbox.co.in description: test - url: https://api.sandbox.co.in description: prod security: [] tags: - name: TDS Compliance Check - name: Download CSI - name: FVU Generation - name: E-File TDS Return - name: TRACES - name: TRACES/TDS Certificate - name: TRACES/Credentials - name: TRACES/Challans - name: TDS - name: TDS Certificate - name: TRACES Credentials - name: Challans paths: /tds/traces/deductors/authenticate: post: tags: - TRACES/Authentication summary: Authenticate with TRACES description: >- Authenticate with a deductor TAN and TRACES password. Returns access and refresh tokens for the TRACES session. Send your Sandbox API access token in the Authorization header. Example credentials and tokens are illustrative. operationId: authenticateTraces parameters: - name: Authorization in: header description: >- Sandbox access token. For token-generation steps, see the [Quickstart guide](https://developer.sandbox.co.in/guides/get-started/quickstart). required: true example: '{{access_token}}' schema: type: string - name: x-api-key in: header description: Sandbox API key. required: true example: '{{api_key}}' schema: type: string - name: Content-Type in: header description: Request body format. required: true example: application/json schema: type: string requestBody: required: true content: application/json: schema: type: object properties: '@entity': type: string enum: - in.co.sandbox.tds.compliance.traces.authentication.request tan: type: string pattern: ^[A-Z]{4}[0-9]{5}[A-Z]$ description: Deductor TAN registered with TRACES. password: type: string minLength: 1 writeOnly: true description: Password for the deductor TRACES account. required: - '@entity' - tan - password examples: Session created: summary: Session created value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: your-traces-password Missing password: summary: Missing password value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A Incorrect TRACES credentials: summary: Incorrect TRACES credentials value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: incorrect-example-password Missing Sandbox authorization: summary: Missing Sandbox authorization value: '@entity': in.co.sandbox.tds.compliance.traces.authentication.request tan: AHMA12345A password: your-traces-password responses: '200': description: Returns access and refresh tokens for the TRACES session. content: application/json: schema: type: object properties: code: type: integer enum: - 200 timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string data: type: object properties: '@entity': type: string enum: - >- in.co.sandbox.tds.compliance.traces.authentication.response access_token: type: string description: >- Deductor access token for TDS challan and bulk PAN verification requests. Obtain a token with [Authenticate a TRACES deductor](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/authenticate). refresh_token: type: string description: >- Deductor refresh token used by [Refresh a TRACES deductor session](https://developer.sandbox.co.in/api-reference/tds/compliance/traces/endpoints/refresh) to renew the TRACES session. access_token_expiry: type: integer format: int64 description: Access token expiry as Unix time in milliseconds. refresh_token_expiry: type: integer format: int64 description: Refresh token expiry as Unix time in milliseconds. required: - '@entity' - access_token - refresh_token - access_token_expiry - refresh_token_expiry required: - code - timestamp - transaction_id - data examples: Session created: summary: Session created value: code: 200 timestamp: 1792176139900 transaction_id: 198e8f90-691e-4c04-afaf-377611afa55f data: '@entity': >- in.co.sandbox.tds.compliance.traces.authentication.response access_token: >- eyJhbGciOiJSU0FTU0FfUFNTX1NIQV81MTIiLCJ0eXAiOiJKV1QiLCJraWQiOiJleGFtcGxlLXNpZ25pbmcta2V5In0.eyJpc3MiOiJhcGkuc2FuZGJveC5jby5pbiIsImF1ZCI6IkFQSSIsImludGVudCI6IkFDQ0VTU19UT0tFTiIsImlhdCI6MTc5MjE3NjEzOSwiZXhwIjoxNzkyMTc3MDQ3fQ.invalid-example-signature refresh_token: >- eyJhbGciOiJSU0FTU0FfUFNTX1NIQV81MTIiLCJ0eXAiOiJKV1QiLCJraWQiOiJleGFtcGxlLXNpZ25pbmcta2V5In0.eyJpc3MiOiJhcGkuc2FuZGJveC5jby5pbiIsImF1ZCI6IkFQSSIsImludGVudCI6IlJFRlJFU0hfVE9LRU4iLCJpYXQiOjE3OTIxNzYxMzksImV4cCI6MTc5MjE4MzM0N30.invalid-example-signature access_token_expiry: 1792177047000 refresh_token_expiry: 1792183347000 '400': description: >- The request body is invalid. Include a TAN and a non-empty TRACES password. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message examples: Missing password: summary: Missing password value: code: 400 timestamp: 1792176147907 transaction_id: 807b7940-d53e-4a19-8ead-718fcaa5868d message: Invalid request body '401': description: >- TRACES rejected the credentials, or the Sandbox Authorization header is missing. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message examples: Incorrect TRACES credentials: summary: Incorrect TRACES credentials value: code: 401 timestamp: 1792176148207 transaction_id: b7000183-316b-46b3-a7b9-494f9d16a995 message: Invalid credentials Missing Sandbox authorization: summary: Missing Sandbox authorization value: code: 401 timestamp: 1792176151923 transaction_id: e1dab6c2-d333-41a3-815b-932f869708e4 message: Unauthorized '403': description: The Sandbox API key or access token is invalid. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message '500': description: TRACES authentication could not be completed. Retry the request. content: application/json: schema: type: object properties: code: type: integer timestamp: type: integer format: int64 description: Unix timestamp in milliseconds. transaction_id: type: string message: type: string required: - code - timestamp - transaction_id - message deprecated: false security: [] ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.