> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tesouro.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick reference

> Base URLs, authentication endpoints, rate limits, and pagination defaults for the Embedded Banking API — every lookup value on one page.

The values you reach for repeatedly while integrating, in one place. Each section links to the full guide for request shapes and detail.

## Base URLs

| Environment | Base URL                          |
| :---------- | :-------------------------------- |
| Sandbox     | `https://api.sandbox.tesouro.com` |
| Production  | `https://api.tesouro.com`         |

Sandbox and production are fully isolated — data and credentials never cross between them. See [Environments](/embedded-banking/api/concepts/environments).

## Authentication

Tokens are issued from the OIDC token endpoint and sent on every request as `Authorization: Bearer <token>`.

| Operation                            | Request                      | Grant type                                        |
| :----------------------------------- | :--------------------------- | :------------------------------------------------ |
| App token (server-to-server)         | `POST /openid/connect/token` | `client_credentials`                              |
| User token (impersonation / widgets) | `POST /openid/connect/token` | `urn:ietf:params:oauth:grant-type:token-exchange` |
| Revoke a token                       | `POST /v1/auth/revoke`       | —                                                 |

App tokens are short-lived — refresh before `expires_in` elapses. See [Client credentials](/embedded-banking/guides/authentication/client-credentials) and [User token](/embedded-banking/guides/authentication/user-token).

## Rate limits

The API allows **30 requests per second**. Exceeding it returns `429 Too Many Requests` with a `Retry-After` header.

| Header                | Meaning                                                                          |
| :-------------------- | :------------------------------------------------------------------------------- |
| `RateLimit-Limit`     | Requests allowed per second. Alias: `X-RateLimit-Limit-Second`.                  |
| `RateLimit-Remaining` | Requests remaining in the current second. Alias: `X-RateLimit-Remaining-Second`. |
| `RateLimit-Reset`     | Seconds until the quota resets.                                                  |
| `Retry-After`         | On a `429`, seconds to wait before retrying.                                     |

Watch `RateLimit-Remaining` to stay under the ceiling, and back off with exponential delays on a `429`, starting from the `Retry-After` value. See [Rate limiting](/embedded-banking/api/concepts/rate-limiting).

## Pagination

List endpoints use cursor-based pagination with the same contract everywhere.

| Parameter          | Default | Notes                                                                                             |
| :----------------- | :------ | :------------------------------------------------------------------------------------------------ |
| `limit`            | 25      | Records per page. Maximum 100.                                                                    |
| `pagination_token` | null    | Opaque cursor from the previous response. Round-trip it unchanged — never parse or construct one. |

Each response carries `nextPaginationToken` (and `prevPaginationToken`). Keep requesting with the returned token until `nextPaginationToken` is `null` — that is the only stop condition. See [Pagination, sorting, and filtering](/embedded-banking/api/concepts/pagination-sorting-filtering).