Get an Access Token
Before you start
Browser users sign in through the normal Custd login. Machine integrations need a tenant-bound credential with scopes for their intended task; an event-writing producer is not automatically allowed to read reports or administer a tenant. Use Provision a producer or your tenant's Admin → Credentials controls. Registration and first login are established before this workflow.
Authenticate the integration
- Store the one-time client secret from provisioning in your application's approved secret store.
- Pass the returned credential bundle to the released SDK's provisioned-producer constructor. Use its returned base URL, token URL and audience.
- Let the SDK obtain and refresh short-lived OAuth tokens, then send one small authorized request. See SDK contract.
- Verify the response and its per-item results where applicable.
For example, a producer created with the events scope template can send one
valid event. It should not be able to query another tenant or administer users.
Do not embed its client secret in browser JavaScript; browser tracking uses the
site's supported tracking configuration.
The underlying OAuth grant is client_credentials: the confidential client
authenticates to its supplied token URL and requests its allowed scope and
audience. The returned access token is sent as Authorization: Bearer <token>.
Use the SDK rather than maintaining your own refresh loop.
Recovery
A 401 calls for checking credential state and token acquisition. A 403 calls for checking the required permission and tenant context, not repeatedly refreshing. If the one-time secret was lost, rotate it through the credential lifecycle; list and inspect operations do not reveal it again. Keep secrets and bearer tokens out of terminal transcripts, URLs and tickets.
Tenant onboarding does not require direct access to the OAuth server's admin API.