> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trelent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Authenticate the SDK with your Trelent client ID and secret.

The Trelent SDK authenticates with a client ID and secret. The SDK exchanges them for short-lived access tokens automatically on each request.

## Get credentials

Ask your Trelent admin for a client ID and secret, then pass them to the `Client`:

```python theme={null}
from trelent_agents import Client

client = Client(
    client_id="your-client-id",
    client_secret="your-client-secret",
)
```

## Environment variables

You can also read credentials from the environment:

```bash theme={null}
export TRELENT_CLIENT_ID="your-client-id"
export TRELENT_CLIENT_SECRET="your-client-secret"
```

```python theme={null}
import os
from trelent_agents import Client

client = Client(
    client_id=os.environ["TRELENT_CLIENT_ID"],
    client_secret=os.environ["TRELENT_CLIENT_SECRET"],
)
```

## Custom API URL

`Client` defaults to `https://agents.trelent.com`. Override it when pointing at a different environment:

```python theme={null}
client = Client(
    api_url="https://api.dev.trelent.com/agent",
    client_id="your-client-id",
    client_secret="your-client-secret",
)
```

## How it works

* The SDK calls `POST /token` on the API with your credentials and the scope needed for the request (e.g. `AgentOrchestrator:runs:create`).
* Tokens are short-lived and cached per scope for the lifetime of the `Client`.
* If a narrow scope is rejected, the SDK transparently retries with a broader one (`AgentOrchestrator:runs:*`, then `AgentOrchestrator:*`).

You generally do not need to think about scopes — the SDK picks the right one per call.