# OAuth device authorization and tax reads (/releases/oauth-device-and-tax-api)

2026-08-12 · API — Additive OAuth endpoints and scopes now support the official CLI, consented entities, and read-only tax data.



<Callout title="API" type="info">
  Additive public API update. Existing authorization-code integrations continue
  to work without changes.
</Callout>

The public OAuth surface now supports the official CLI's device authorization
flow and read-only access to personal or consented legal-entity tax records.

## OAuth additions [#oauth-additions]

* The [device authorization endpoint](/reference/oauth-device-authorization) issues a user code and verification URL for the registered official CLI.
* The token endpoint supports device-code polling by that public client.
* The [revocation endpoint](/reference/oauth-revoke) accepts the official public client without an embedded secret.
* OpenID discovery publishes the device and revocation capabilities supported by the server.

The device flow is currently reserved for the official CLI. Third-party OAuth
clients continue to use the authorization-code flow with PKCE.

## New consented data [#new-consented-data]

The following OAuth scopes are available:

| Scope                             | Access                                              |
| --------------------------------- | --------------------------------------------------- |
| `eprospera:entity.read`           | Profiles for legal entities selected during consent |
| `eprospera:entity.documents.read` | Documents for selected legal entities               |
| `eprospera:person.tax.read`       | The signed-in user's tax status and filings         |
| `eprospera:entity.tax.read`       | Tax data for selected legal entities                |

New read-only resources include:

* [Consented legal entities](/reference/oauth-get-legal-entities)
* [Tax obligations](/reference/oauth-get-tax-summary)
* [Submitted tax filings](/reference/oauth-list-tax-filings)
* [One submitted filing](/reference/oauth-get-tax-filing)
* [Tax assessment and return downloads](/reference/oauth-download-tax-document)

Entity selection during consent does not override representation checks. If a
user stops representing an entity, later requests stop returning its data.
These endpoints do not create, modify, submit, or pay tax filings.

See [OAuth 2.0 / OpenID Connect](/oauth-overview) for the protocol details and
[Tax and legal-entity data](/tax-and-entity-data) for examples and confidential-data
handling.