Acquiring Credentials for a Web Service User¶
Introduction¶
This document is intended for Economic Operators involved in the EU Deforestation Regulation having an IT system which manages electronically their statements (Due Diligence Statements or Simplified Declarations) and willing to develop the interconnection with the central EUDR system to submit the information in an automated manner. It is also intended for public institutions or private companies willing to develop software to service Economic Operators' needs in submitting information to the central EUDR system. This includes the information exchange introduced by the EUDR Amendment Regulation (2025/2650).
Acquiring Credentials for a Web Service User¶
Creation of an operator and a user in EUDR¶
The participant needs to manually create the "Operator" corresponding to the company to be registered in the system or join an existing one.
Details on this process can be found in the EUDR user guide which can be accessed through this link: Deforestation Regulation Implementation
For every Operator, at least one user must also be created. That first user will be the reference (administrator) user, which will be recorded as the "responsible person" in the operator. It cannot be an anonymous or fictional account.
Alternatively, if the operator entry already exists, the web service user can request and join this operator instead of creating a new one.
Warning
Web Service users cannot belong to more than one Operator entity.
Request and get authorization for the Web Service user¶
Once the Operator is created and validated, and user successfully joined, proceed to acquire a "web service user" and an authentication key:
Recommended approach
Complete the credential setup and test your integration in the acceptance environment first. Once connectivity and authentication are verified, repeat the process for the production environment.
1. Get the username of the EU Login account¶
To locate the username, follow the next steps:
- Log in to the EUDR Information System,
- Click in the top-right corner of the screen,
- In the Popup, click on "Edit Profile":
- In the right box "Personal Information" there is an attribute "username". This value can now be used within your system for later tasks.
2. Get the "Authentication key" for the Participant's system¶
- Go back to the page "Edit your profile",
- Scroll to the section "Web Services Access",
- If the previous steps have been completed successfully, the button "Active" should appear in this Section. Click on this Button. The section will contain a new field labeled "Authentication Key". Click the "eye" next to the field to see the value. This value can now be used within the procedure described in later tasks.
Authentication Key is Private
The Authentication Key is private and should only be used with your application. The person identified by the EU Login user that was created in the first step is responsible for the data that shall be submitted into EUDR.
Usage Recommendations and Limits¶
Statement (DDS / SD) Retrieval Service Limits¶
The following recommendations are intended to ensure fair and stable use of the shared EUDR Information System when accessing it via Web Services. Operators are encouraged to design their integrations so that they remain within the limits described below and avoid unnecessary load on the system.
When planning bulk retrievals, operators should design batching strategies that respect these limits and avoid repeatedly requesting the same datasets where local caching can be used instead.
Global and individual IP throttling limits¶
| Retrieval Method | Limit |
|---|---|
| Retrieved via UUID | 100 DDS / SD per call |
| Retrieved via Internal Reference Number | 1000 DDS / SD per call |
| Limit Type | Value |
|---|---|
| Global limit | 10,000 calls per minute |
| Per-IP limit | 5 calls per second |
These limits will be monitored and may be adjusted depending on system load.
Note
It is highly recommended that Web Service users respect these guidelines to allow fair use of resources for all users. Sustained abuses may lead to operator accounts being further limited.
Recommended Business Behaviour¶
To support stable and fair use of the EUDR Information System, operators and traders are encouraged to align their usage with the system's technical limits.
In addition to respecting the rate limits (10,000 requests per minute globally and 5 requests per second per IP), users should:
- Avoid unnecessary high-frequency polling — after submitting a DDS, allow at least 30 minutes before checking its status to support efficient completion of internal processes, including risk assessment.
- Use caching and structured retry intervals — this contributes to balanced system utilisation and reduces unnecessary load on the system.
- Prepare complete and accurate data before submission — this facilitates compliance with the 25 MB size limit and reduces repeated uploads.
- Consolidate DDS within the regulatory framework — rather than fragmenting them excessively, this supports efficient processing and clearer traceability.
- Organise mixing for bulk commodities in accordance with traceability rules — avoid dependence on widespread "declaration in excess" practices.
These behaviours support smooth system functioning, timely processing and checks, and fair access for all users of the public IT infrastructure.