{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-@l10n/fr/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Authentication"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authentication","__idx":0},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Trace One APIs accept only tokens from the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OAuth 2.0 client credentials"]}," flow, issued to your application. A token issued to a person (someone signed in to a Trace One application) is refused with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"get-a-token","__idx":1},"children":["Get a token"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":""},"children":[]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Token URL"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://ws-users.traceone.com/default/connect/token"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grant type"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_credentials"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Scope"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["t1_api"]}," (the only scope)"]}]}]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"POST https://ws-users.traceone.com/default/connect/token\nContent-Type: application/x-www-form-urlencoded\n\ngrant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET&scope=t1_api\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Response:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"access_token\": \"eyJhbGci...\",\n  \"expires_in\": 3600,\n  \"token_type\": \"Bearer\",\n  \"scope\": \"t1_api\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send the token in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header of every call:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"Authorization: Bearer eyJhbGci...\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"keep-and-renew-the-token","__idx":2},"children":["Keep and renew the token"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reuse the token"]}," for all your calls until it expires. Do not request a token per call."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Read ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["expires_in"]}]}," (seconds) from the response. Do not hard-code the lifetime."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Renew it early"]},", for example one minute before it expires."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["On a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401"]}]},", request a new token and retry the call ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["once"]},". If the call fails again, stop and check your credentials."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"python","header":{"controls":{"copy":{}}},"source":"import time\nimport requests\n\nTOKEN_URL = \"https://ws-users.traceone.com/default/connect/token\"\n_token = {\"value\": None, \"expires_at\": 0}\n\ndef get_token():\n    if _token[\"value\"] and time.time() < _token[\"expires_at\"] - 60:\n        return _token[\"value\"]\n    response = requests.post(TOKEN_URL, data={\n        \"grant_type\": \"client_credentials\",\n        \"client_id\": CLIENT_ID,\n        \"client_secret\": CLIENT_SECRET,\n        \"scope\": \"t1_api\",\n    })\n    response.raise_for_status()\n    body = response.json()\n    _token[\"value\"] = body[\"access_token\"]\n    _token[\"expires_at\"] = time.time() + body[\"expires_in\"]\n    return _token[\"value\"]\n","lang":"python"},"children":[]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"keep-the-secret-safe","__idx":3},"children":["Keep the secret safe"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use the credentials ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["on your server only"]},". Never put them in a browser page, a mobile app or a desktop app."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store the secret in a secret store or an environment variable, never in source control."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If the secret may have leaked, ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/fr/getting-started/support"},"children":["contact us"]}," to replace it."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"401-and-403","__idx":4},"children":["401 and 403"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Status"},"children":["Status"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Meaning"},"children":["Meaning"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What to do"},"children":["What to do"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["401 Unauthorized"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token is missing, expired, invalid, or was not issued by the client credentials flow"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Get a new token and retry once"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["403 Forbidden"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The token is valid, but your company has no access to this resource or operation"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Do not retry. Check that the resource belongs to your company or is shared with it"]}]}]}]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":5},"children":["Next steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/fr/getting-started/coding-practices"},"children":["Coding practices"]}," — pagination, batch reads, enums, languages"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/fr/getting-started/errors"},"children":["Errors"]}," — status codes and the error body"]}]}]},"headings":[{"value":"Authentication","id":"authentication","depth":1},{"value":"Get a token","id":"get-a-token","depth":2},{"value":"Keep and renew the token","id":"keep-and-renew-the-token","depth":2},{"value":"Keep the secret safe","id":"keep-the-secret-safe","depth":2},{"value":"401 and 403","id":"401-and-403","depth":2},{"value":"Next steps","id":"next-steps","depth":2}],"frontmatter":{"title":"Authentication","description":"How to get an access token, keep it, renew it, and what 401 and 403 mean.","seo":{"title":"Authentication"}},"lastModified":"2026-10-27T11:55:12.929Z","isTranslationFallback":true,"pagePropGetterError":{"message":"","name":""}},"slug":"/fr/getting-started/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}