Tridion Sites 9.6 - introduced enhancements to support all the clients to use Access Management for authentication.

I was looking to figure out, How to use Access Management Bearer tokens to authenticate with Tridion Sites 9.6 WCF Core-service?

1 Answer 1


I did spend some time with @Rick to figure it out, just sharing it with the community.

We found out it comes with precompiled Core Service Client (Tridion.ContentManager.CoreService.Client.dll) and has some built-in support.

factory.Endpoint.Behaviors.Add(new BearerTokenEndpointBehavior(() => token.AccessToken));


static ICoreService GetClientHttpSites(string hostname, string username, string password)
            var basicHttpBinding = new BasicHttpBinding
                MaxBufferSize = 10485760, // 4MB
                MaxBufferPoolSize = 10485760,
                MaxReceivedMessageSize = 10485760,
                ReaderQuotas = new System.Xml.XmlDictionaryReaderQuotas()
                    MaxStringContentLength = 10485760, // 4MB
                    MaxArrayLength = 10485760,

            hostname = string.Format("{0}{1}{2}", hostname.StartsWith("http") ? "" : "http://", hostname, hostname.EndsWith("/") ? "" : "/");
            var endpoint = new EndpointAddress(hostname + "webservices/CoreService202101.svc/basicHttp");
            var factory = new ChannelFactory<ICoreService>(basicHttpBinding, endpoint);

            var clientId = WebConfigurationManager.AppSettings["clientId"]; 
            var clientSecret = WebConfigurationManager.AppSettings["clientSecret"]; 
            var am = WebConfigurationManager.AppSettings["am"]; //http://access.tridiondemo.com/access-management

            var data = new FormUrlEncodedContent(new Dictionary<string, string>
                {"grant_type", "client_credentials"},
                {"client_id", clientId},
                {"client_secret", clientSecret}
            HttpClient httpClient = new HttpClient();
            var auth = httpClient.PostAsync($"{am}/connect/token", data).Result;
            var token = JsonConvert.DeserializeObject<Token>(auth.Content.ReadAsStringAsync().Result);

            factory.Endpoint.Behaviors.Add(new BearerTokenEndpointBehavior(() => token.AccessToken));
            return factory.CreateChannel();

As per your environment clientId and clientSecret - you can create in the access management for the service user account.

Note: This BearerTokenEndpointBehavior authentication only supported on the latest CoreService202101.svc

  • 1
    To clarify: The BearerTokenEndPointBehavior is implemented in T.CM.CoreService.Client v9.6. This requires use of the Core Service 202101 contracts/endpoints (which are introduced in Tridion Sites 9.6). More specifically, support for OAuth Bearer Tokens only applies to the Core Service HTTP-based endpoints (both basicHttp and wsHttp, but not netTcp), so that implies it's only supported for CoreService202101.svc, indeed. Apr 6 at 12:13
  • 1
    Also note that Access/Bearer Tokens will expire (typically in an hour). So if you obtain the Access Token when you create the Core Service Client (as shown in this example) and keep your Core Service Client alive for a long time, after an hour you will get errors that the Access Token has expired. Production code should take Access Token expiration into account and obtain a new one before the old one expires. Apr 6 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.