Skip to main content
Migrate API applications to Thomson Reuters Account
Search
Search Account management Support Help and Support.

This article applies to:

  • Product: ONESOURCE Platform

Prepare for API application changes

Prepare an API application for migration from Apigee-based authentication to Thomson Reuters Account (Auth0)-based authentication.
Complete the following steps whether you migrate from an existing application or onboard a new one.
  1. Decide which authentication method fits each application.
    1. Select
      Client Credentials
       or
      Client Assertion
       for machine applications.
      Client Credentials uses a shared secret; Client Assertion uses a key pair.
    2. Select
      Authorization Code
       for user applications. PKCE is mandatory, with no exceptions.
    note
    If you're already using Client Assertion today, your already-registered public key is reused automatically to set up your Thomson Reuters Application. You can change the certificate afterward if you'd like.
  2. Review your current API applications and choose your upgrade path.
    Upgrade an existing application in place, or create a new Thomson Reuters Application and cut over. Once an application is upgraded, it can't be reverted to Apigee-based authentication.
  3. Plan for the credential change.
    Managing and rotating your Client Secret becomes your responsibility. We recommend rotating at least every 12 months.
  4. Review best practices before you migrate.
    Cache your tokens and respect the rate limit (40 token requests per hour, per client) so your integration isn't rate-limited or blocked after the change.
  5. Check for client-specific scopes.
    If your integration requests client scopes (for example,
    urn:tr:onesource:auth:client:<client>
    ) to add client information to the token, plan to identify the client on each API call instead. Client-specific scopes aren't supported for Thomson Reuters Applications.
  6. Validate before you switch production traffic.
    Test your updated integration end to end in a lower environment, or against a test application, before you cut over production.

Related Content