# Authenticate a machine client

Canonical page: https://docs.ovok.com/python-sdk/guides/machine-clients

A backend service that acts for itself, not for a user, signs in with an OAuth client ID and
secret. Pass both to the client:

```python
import os

from ovok_sdk import Ovok

ovok = Ovok(
    "https://api.sandbox.ovok.com",
    "your-tenant",
    client_id=os.environ["OVOK_CLIENT_ID"],
    client_secret=os.environ["OVOK_CLIENT_SECRET"],
)

patients = ovok.fhir.search("Patient", {"_count": "20"})
```

The client fetches its token on the first request and renews it before it expires. It never
stores the token. `ovok.auth.login` is for user clients; a machine client does not need it.

Keep the secret out of source code. `client_secret` without `client_id` raises
`OvokConfigError` when the client is constructed.