Authentication

Aspose.Words Cloud uses OAuth 2.0 Client Credentials flow with JWT Bearer tokens. All API requests require an Authorization: Bearer <token> header.

Get Credentials

API authentication uses a Client Id (a UUID) and Client Secret (a hex string) — separate from your dashboard login. Create them in the Aspose Dashboard:

Go to Applications and click Create New Application
Enter a name and description for your app. Select a default storage — create one first via Storages if needed
Click Save. The app appears in your applications list
Click on the app card to view its details. Both Client Id and Client Secret are displayed with copy buttons. To replace a compromised secret, use Regenerate Client Secret

The application details page also lets you configure:

Application Limits — set optional daily or monthly caps on API calls for this app. Useful for controlling usage per client or environment
CORS Origin — optional. Only needed if you call the Words Cloud API directly from browser JavaScript (fetch, XMLHttpRequest). Server-side applications (SDKs, curl, backend code) do not require CORS configuration. Add each allowed domain on a separate line (e.g., https://myapp.com)

The same credentials work across all Aspose Cloud products — Words, PDF, Cells, and more.

Obtain an Access Token

Send your credentials to the authentication endpoint:

cURL

curl -X POST "https://api.aspose.cloud/connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Accept: application/json" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET"

Python

import requests

response = requests.post(
    "https://api.aspose.cloud/connect/token",
    data={
        "grant_type": "client_credentials",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET"
    },
    headers={"Content-Type": "application/x-www-form-urlencoded"}
)
token = response.json()["access_token"]

using Aspose.Words.Cloud.Sdk;

var config = new Configuration
{
    ClientId = "YOUR_CLIENT_ID",
    ClientSecret = "YOUR_CLIENT_SECRET"
};
var api = new WordsApi(config);
// Token is obtained and managed automatically by the SDK

Java

import com.aspose.words.cloud.*;

WordsApi api = new WordsApi(
    "YOUR_CLIENT_ID",
    "YOUR_CLIENT_SECRET",
    "https://api.aspose.cloud"
);
// Token is obtained and managed automatically by the SDK

Response — a JSON object with your access token:

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer"
}

Use the Token

Include the token in the Authorization header of every API request:

curl -X GET "https://api.aspose.cloud/v4.0/words/info" \
  -H "Authorization: Bearer YOUR_TOKEN"

SDKs handle authentication automatically — pass your credentials once when creating the API client, and the SDK manages token acquisition and renewal.

Token Lifetime

Cache the token and reuse it until expiration — do not request a new token for each API call
On HTTP 401, request a fresh token and retry
The expires_in field in the token response indicates the remaining validity period

Security Best Practices

Store credentials in environment variables, not in source code:

export ASPOSE_CLIENT_ID="your_client_id"
export ASPOSE_CLIENT_SECRET="your_client_secret"

Rotate credentials periodically via the Aspose Dashboard — use Regenerate Client Secret on your application details page
All API communication is encrypted via HTTPS

→ Quickstart: Make your first API call → Full OAuth2 details (Aspose.Total)

Quickstart Base URL & Environments