An API client is a set of credentials that lets a script, an integration or an AI agent call the Trace.Space REST API on your behalf. A client acts with the permissions of the user who created it, so it can never see or change more than you can.
API clients live on Organization settings > Integrations, in the API Clients section. Click the gear icon at the top of the left sidebar, choose Organization settings, then Integrations. Any member can create API clients; you do not need to be an org admin. The REST API documentation link in this section opens the interactive API reference.
Creating an API client
Click New API Client.
Enter a Name that tells you what the client is for, then click Create API Client.
The API Client Credentials dialog shows the Client ID and the Client secret. Copy both with the copy buttons. The secret is shown only this once, so store it somewhere safe.
Optionally click Download skill (see below), then click Done.
Getting a token
The API uses the OAuth 2.0 client credentials flow. Exchange the client ID and secret for a bearer token, then send that token with every request. Tokens last 15 minutes; request a new one when a call returns 401.
curl -X POST "https://api.tracespace.ai/auth/oauth/token" # North America; Europe: https://api.tracespace.app \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=client_credentials&client_id=&client_secret="
The response contains an access_token. Use it as Authorization: Bearer <token> on API calls. Send Target-Organization: <org domain name> on every call as well. The client token is bound to your organization, but the header is what the API documents and what keeps scripts working if a token ever covers more than one organization.
The downloadable API query skill
Download skill in the credentials dialog saves a file named SKILL.md. It is a ready-to-use instruction file for an AI coding agent (Claude Code, Cursor and similar) that explains how to authenticate, how to filter and search items, and which endpoints exist, with your client ID and secret already filled in. Point your agent at the file and ask it to fetch or update Trace.Space data. The file separates the endpoints that only read from the ones that change data, and warns the agent before it takes an action that writes.
Because the file contains live credentials, keep it private. Do not share it or commit it to a repository unless you remove the credentials first. You can download the skill again later from any secret's credentials dialog after creating a new secret.
Managing clients and secrets
Each client is listed with its name, Client ID and who created it when. Expand a client to see its secrets, shown by their last characters.
New secret adds a second secret to the same client, for example to rotate credentials without downtime. A client can have up to 5 secrets.
Hover over a secret and click Revoke to stop it from issuing new tokens. Tokens already issued keep working until they expire.
The switch on the client header disables the client without deleting it; turn it back on to re-enable it.
Hover over the client header and click the bin icon to delete the client and all its secrets. This cannot be undone.
