> For the complete documentation index, see [llms.txt](https://developers.bloomcredit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developers.bloomcredit.io/docs/v2.1/enablement-services/enablement-services-getting-started/enablement-services-authentication.md).

# Enablement Services Authentication

## Authentication

Enablement Services supports multiple authentication scopes, depending on the level of access required. Organization scope allows for operations at an organization level, things like creating new users and authenticating users. User scope allows for operations on an individual user basis, like importing connections or viewing tradelines.

API requests require a valid 'Authorization' header.

### Organization Scope

This scope is used to interact with organization wide resources. This can be used for operations like creating and authenticating users.

Client Credentials authentication is appropriate for server-to-server use cases. Exchange your client credentials for an access token that will be sent with subsequent requests. Don't expose your organization scoped access token in client-side code, Github or any other insecure location.

To use Client Credentials authentication view our API authentication guide [API Authentication](https://developers.bloomcredit.io/reference/v2.1/)

### User Scope

This scope is used to interact with an individual user's data, for example importing connections or retrieving tradelines.

#### Authenticating A User

Once a user has been created you will need to generate an access token that will be passed with every subsequent request to the graphql endpoint. This requires Organization scoped authentication. You will need an access token created by following the [Organization Scope](#organization-scope) guide above. You will also need the `user_id` for the user being authenticated. This is the `user_id` that was returned from your call to [RegisterOrganizationUser](/docs/v2.1/enablement-services/mutations/registerorganizationusermutation.md)

The HTTP endpoint `/v2/users/<user_id>/authenticate` is used to obtain the access token for User Scoped Authentication.

Base URL based on environment:

* Use the Development URL when testing or working in a development environment.
* Use the Production URL when making live requests.

| Development                 | Production                  |
| --------------------------- | --------------------------- |
| `https://api.bloomplus.dev` | `https://api.bloomplus.com` |

{% tabs %}
{% tab title="cURL" %}

```bash
# Replace user_id with the user's id. 
# Replace client_id and client_secret with your organization's client_id and client_secret

curl --location --request POST 'https://api.bloomplus.dev/v2/users/<user_id>/authenticate' \
--header 'Authorization: Bearer <organization_scoped_access_token>'

# Returns: {"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30", "expiresIn": 7200, "token_type": "Bearer"}
# Which can then be used as a bearer token:
# --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
```

{% endtab %}

{% tab title="Go" %}

```go
package main

import (
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
)

func main() {
    // Define the user ID as a path parameter
    userID := "your-user-id"
    url := fmt.Sprintf("<BASE_URL>/v1/users/authenticate/%s", userID)

    // Create a new HTTP POST request
    req, err := http.NewRequest("POST", url, nil)
    if err != nil {
        log.Fatalf("Error creating request: %v", err)
    }

    // Set the Authorization header with client credentials
    clientID := "your-client-id"
    clientSecret := "your-client-secret"
    authHeader := fmt.Sprintf("Bearer %s:%s", clientID, clientSecret)
    req.Header.Set("Authorization", authHeader)

    // Send the request
    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        log.Fatalf("Error making request: %v", err)
    }
    defer resp.Body.Close()

    // Read and process the response, expecting a plain string for the session token
    body, err := ioutil.ReadAll(resp.Body)
    if err != nil {
        log.Fatalf("Error reading response: %v", err)
    }

    if resp.StatusCode == http.StatusOK {
        // The response is a plain string containing the session token
        sessionToken := string(body)
        fmt.Printf("Successfully authenticated!\nSession Token: %s\n", sessionToken)
    } else {
        // Handle the error response
        var errorResponse map[string]string
        err = json.Unmarshal(body, &errorResponse)
        if err != nil {
            log.Fatalf("Error decoding error JSON: %v", err)
        }
        fmt.Printf("Error: %s\n", errorResponse["error"])
    }
}

```

{% endtab %}
{% endtabs %}

For example, if the access token `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30` were returned, it will be used as a Bearer token in the format:

`Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30`

This bearer token can now be used for User Scoped queries and mutations for the authenticated user.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://developers.bloomcredit.io/docs/v2.1/enablement-services/enablement-services-getting-started/enablement-services-authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.