Get an access token using client credential clients

Before you can make API requests to your CONNECT account, you must obtain a valid access token using a client credential client. Client credentials are used for machine-to-machine authentication, allowing applications to access resources without a user context. By following these instructions, you'll exchange your client credential client (client ID and secret) for an access token. This authentication method is appropriate for background processes, service accounts, and API-to-API communication.

Prerequisite

A valid client ID and client secret for a client credential client used to exchange for an access token. If you don't already have these credentials, see Create client. To create a client, you must have a role assignment that includes access to the Identity service with the permission to create a client.

The client credential client must also have a role assignment, which determines the access token's permissions within the account. For more information on creating a role assignment for the client credential client, see Create new role assignment.

Token endpoint information

• Production environment: https://identity.platform.connect.aveva.com/account/{account-id}/authentication/connect/token

• Required scope: api (this must be provided in the token request and is case sensitive)

Get a token manually with Postman

Manual token retrieval with Postman is useful for several scenarios including: testing your client credentials during initial setup, exploring the API endpoints before writing code, troubleshooting authentication issues, or demonstrating the authentication flow to team members. Postman provides a visual interface that makes it easy to verify your credentials work correctly and inspect the token response.

For manual token acquisition, Postman is the recommended approach.

1. Create a new POST request.

2. Set the URL to your token endpoint (listed above).

3. In the Body tab, select x-www-form-urlencoded.

4. Add the following key-value pairs:

   • grant_type: client_credentials

   • client_id: {your-client-id}

   • client_secret: {your-client-secret}

   • scope: api

5. Send the request.

Get a token programmatically

For automated or production scenarios, retrieval of access tokens programmatically within your application code is recommended. CONNECT supports standard OAuth 2.0 client credential flows, making it compatible with libraries in most programming languages. Below are implementations using several common methods, including the recommended Duende IdentityModel library for C# applications, cURL for command-line operations, and guidance for other programming languages.

Notes

• If the library you use sends the client ID and client secret in the request headers (rather than the body), ensure they are URL-encoded before being Base64 encoded.

• Store client credentials securely. Never expose them in client-side code and never check them into source control.

C# with Duende IdentityModel

This approach is suitable for .NET applications or services that need to authenticate with CONNECT at runtime. The Duende IdentityModel library enables secure, programmatic acquisition of access tokens as part of your application’s workflow. This method is commonly used in production systems, automation, or scenarios where token retrieval is integrated into application logic.

using Duende.IdentityModel.Client;

// Create HTTP client

using var client = new HttpClient();

// Discover endpoints from metadata

var disco = await client.GetDiscoveryDocumentAsync(

"https://identity.platform.connect.aveva.com/account/{account-id}/authentication/.well-known/openid-configuration");

if (disco.IsError)

{

Console.WriteLine($"Discovery error: {disco.Error}");

return;

}

// Request token

var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest

{

Address = disco.TokenEndpoint,

ClientId = "your-client-id",

ClientSecret = "your-client-secret",

Scope = "api"

});

if (tokenResponse.IsError)

{

Console.WriteLine($"Error: {tokenResponse.Error}");

Console.WriteLine($"Description: {tokenResponse.ErrorDescription}");

return;

}

// Use the access token

string accessToken = tokenResponse.AccessToken;

Console.WriteLine($"Access Token: {accessToken}");

cURL

This method can be used for testing, troubleshooting, or automation from the command line. It is also useful for demonstrating the HTTP request and response flow without writing application code.

curl --location 'https://identity.platform.connect.aveva.com/account/{account-id}/authentication/connect/token' \

--header 'Content-Type: application/x-www-form-urlencoded' \

--data-urlencode 'grant_type=client_credentials' \

--data-urlencode 'client_id=your_client_id' \

--data-urlencode 'client_secret=your_client_secret' \

--data-urlencode 'scope=api'

Other languages

Any OAuth 2.0 client library for your preferred programming language should work with CONNECT. Standard OAuth 2.0 client libraries are available for most programming languages, such as Python, Java, JavaScript, and Go. This approach is used to integrate CONNECT authentication into applications built with different technology stacks, allowing secure retrieval and use of access tokens. When implementing:

• Use the Client Credentials grant type.

• Set the token endpoint URL.

• Provide your client ID and secret.

• Request the api scope.

Response format

A successful response will be a JSON object with the following properties:

{

"id_token": null,

"access_token": "eyJhbGciOiJSUz...",

"expires_in": 3600,

"token_type": "Bearer",

"refresh_token": null,

"scope": "api"

}

Use the access token

Include the access token in the Authorization header of subsequent API requests.

Troubleshooting

• 400 Bad Request: Ensure all required parameters are correctly formatted. All errors will be 400 errors.