Skip to navigation
Get Started

Authentication

OAuth 2.0 client credentials and bearer tokens.

Travelers APIs authenticate with an OAuth 2.0 client credentials grant. You exchange the client id and secret issued for your integration for a short-lived access token, then send that token as a bearer token on every request.

1. Request an access token

Token request
curl -X POST https://api.travelers.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=$TRAVELERS_CLIENT_ID" \
  -d "client_secret=$TRAVELERS_CLIENT_SECRET" \
  -d "scope=surety claims payments"

2. Call an API with the token

Authenticated request
curl https://api.travelers.com/suretyb2b/api/healthCheck \
  -H "Authorization: Bearer $ACCESS_TOKEN"

With the SDK

The SDK handles the bearer token for you — pass it once at construction:

import { TravelersClient } from "@travelers/sdk";
const client = new TravelersClient({ token: process.env.TRAVELERS_TOKEN });

Client secrets are confidential. Store them in a secrets manager, never in source control, and rotate them on the schedule agreed with your program manager.