> ## Documentation Index
> Fetch the complete documentation index at: https://traddal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Send a bearer token with every request.

All Admin API requests require a bearer token:

```bash theme={null}
curl https://{partner}.mytraddal.com/admin/api/v1/me \
  -H 'Authorization: Bearer {access_token}'
```

Get a token with the `client_credentials` grant using an API client created
in **Settings → Developers → API clients**:

```bash theme={null}
curl -X POST https://{partner}.mytraddal.com/admin/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id={client_id}' \
  -d 'client_secret={client_secret}'
```

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600
}
```

## Scopes

Each API client is granted scopes when it's created (and they can be
amended later). A request to a route the token isn't scoped for returns
`403 { "success": false, "message": "Missing scope: …" }`.

| Scope                | Grants                                                             |
| -------------------- | ------------------------------------------------------------------ |
| `consignments:read`  | Read consignments                                                  |
| `consignments:write` | Create and amend consignments                                      |
| `customers:read`     | Read customers                                                     |
| `customers:write`    | Create and amend customers                                         |
| `catalogue:read`     | Read catalogue items                                               |
| `catalogue:write`    | Create and amend catalogue items                                   |
| `classify:read`      | HS classification (`/classify/*`, `/usage-history/classify`)       |
| `calculate:read`     | Duty calculation (`/calculate/*`, `/usage-history/calculate`)      |
| `restrict:read`      | Restricted-goods checks (`/restrict/*`, `/usage-history/restrict`) |
| `screen:read`        | Denied-party screening (`/screen`)                                 |

Tokens are also partner-bound: the organization on the token must match the
`{partner}` subdomain you call, otherwise the request is rejected. An API
client can additionally be pinned to a single customer — such a key only
sees that customer's consignments and creates on their behalf.

See the [authentication guide](/guides/authentication) for token lifetimes
and how partner isolation is enforced.