Platform · TutorialPreview
Authenticate a workload
Prepare a sandbox integration with short-lived credentials, least-privilege scopes and traceable request context.
- Audience
- Developer, Administrator, Risk and compliance
- Owner
- Platform security
- Last reviewed
- Jul 19, 2026
- Reading time
- 12 min
On this page
Before you begin
Use a sandbox credential supplied for your DTcom environment. Keep credentials outside source control, assign only the scopes required by the workload, and use separate credentials for sandbox and production.
Configure the request context
- 01
Export the sandbox environment
Set the base URL and short-lived access token in your shell. Never place a production credential in documentation, client-side code or a committed environment file.
bashexport DTCOM_BASE_URL="https://api.sandbox.dtcom.ai/v1" export DTCOM_ACCESS_TOKEN="<short-lived-access-token>" - 02
Send the bearer token
Include the access token in the Authorization header and request JSON responses explicitly.
bashcurl --request GET \ --url "$DTCOM_BASE_URL/accounts?ownerId=customer_123" \ --header "Authorization: Bearer $DTCOM_ACCESS_TOKEN" \ --header "Accept: application/json" - 03
Add a request identifier
Supply a caller-generated UUID so application logs, gateway telemetry and support investigation can refer to the same request.
bash--header "X-Request-Id: 5c09305d-f4cb-46e3-a8bf-f567f28b7c5d"
Required request context
Authorizationheader · Required- Bearer access token issued for the calling workload.
Acceptheader- Use application/json for resource responses.
Content-Typeheader- Required for requests containing a JSON body.
X-Request-Idheader- Caller-generated UUID used for end-to-end correlation.
Idempotency-Keyheader- Required by preview payment creation and recommended for safely retried POST requests.
Continue learning