> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trepzy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth and grants

> Machine credentials, human OAuth, and sandbox Try It tokens.

# Auth and grants

[Intro](#intro)

<h2 id="intro">
  Intro
</h2>

Public calls use a Trepzy machine credential (`tpztest_` in sandbox, `tpzlive_` in live) or a short human token. Grants are least privilege. Managing credentials is a human action; machines cannot self-escalate.

`retrieveDispute` requires `disputes:read`. The wire field remains `dispute_ref`. The public `operation_id` is `retrieveDispute`.

See [environments](./environments#intro) and return to [getting started](./getting-started#intro).

<h2 id="try-it">
  Try It
</h2>

Docs Try It is sandbox-only:

* audience `sandbox`, scope `docs_try_it`, consent required
* CORS allowlist is exactly `https://docs.trepzy.com`
* Mintlify proxy stays off; the browser calls sandbox directly
* tokens never appear in URL, static HTML, analytics, logs, or persistent cache
* logout and expiry revoke the session

```ts theme={null}
const operationId: string = 'retrieveDispute'
const audience: string = 'sandbox'
const scope: string = 'docs_try_it'
```