To let software file a due diligence statement through the TRACES-NT API, TRACES needs to recognise the account behind the request. That comes down to three things: an EU Login for a real person, an operator registered in the EUDR system, and a web-service access whose authentication key the software presents on every call. This guide walks all three, end to end. It is the setup that sits underneath the manual TRACES filing walkthrough, so do it once and filing through the TRACES-NT API becomes possible.
One thing to keep straight from the start: getting these credentials ready is not the same as filing anything, and it is certainly not approval. A configured key means your software can submit a statement when you choose to. It says nothing about whether a statement has been submitted, accepted or checked. Nobody at the Commission reviews your account when you generate a key.
TRACES, TRACES-NT and EU Login: what you actually sign in to
The three names get used interchangeably and it costs people an afternoon. TRACES-NT is the Commission platform, the EUDR system runs inside it, and EU Login is the sign-on that guards the door. There is no separate EUDR login to create, and no plotvera account will get you in: you sign in at the Commission address with an EU Login, then request the operator role.
- EU Login: the account itself, held by a named person and protected by two-factor. If your company already uses one for another Commission service, reuse it.
- TRACES-NT: the platform. Holding a TRACES account for another regime, such as sanitary certificates, does not give you the EUDR role; that is requested separately.
- The EUDR system: what you request access to as an operator. Acceptance and production are two independent systems with separate accounts and separate keys.
What the three TRACES-NT API credentials are
- EU Login: the European Commission's single sign-on. Every TRACES action hangs off one, created for a named natural person at your company rather than a shared inbox.
- EUDR operator registration: your company as an operator inside the EUDR module of TRACES, in the member state where you are established, carrying your EORI number.
- Web-service access and its authentication key: a machine credential activated on your operator profile. The username plus the key are what an API client authenticates with. The key is shown once, at generation.
Before you start: pick the right environment
TRACES runs two separate systems. The acceptance (also called replication or training) environment is for rehearsal, and it is where the screenshots below were taken; anything you register there is throwaway and its database is refreshed regularly. The production environment is the real one that customs sees. Credentials do not carry across, so register and generate a key in whichever environment you will actually file against. Rehearsing the whole flow in acceptance first is the single best preparation for doing it for real.
Step 1: create an EU Login
You reach the EUDR system through the TRACES portal and sign in from there. Production, the live system customs sees, is at https://eudr.webcloud.ec.europa.eu/tracesnt/; the acceptance (test) system, the safest place to rehearse the whole flow first, is at https://acceptance.eudr.webcloud.ec.europa.eu/tracesnt/. On either page you select Log in, which hands you to EU Login.
If your company already uses EU Login for another Commission service, reuse it; you do not need a second one. Otherwise, create an account for a specific person who will be accountable for the filings, and complete the two-factor setup, which the login requires. Adding a second registered user later is cheap insurance against holidays and departures, because a locked-out sole account stops your filing entirely.
Step 2: register your EUDR operator in TRACES
Sign in to the EUDR system. A brand-new account holds no role, so TRACES asks what kind of organisation you are requesting access for. Choose Operator, which covers ordinary economic operators and downstream businesses.
Fill the operator form for your company: legal name, country of establishment and at least one address. In the activity block, set the section to EUDR and the activity to EUDR Operator. This is the part people miss, and without it the profile cannot file.
Add your EORI under operator identifiers. If you import or export, an EORI is mandatory and TRACES enforces it at validation time, so a missing or malformed one surfaces later as a rejected statement rather than an error here. Each EORI is unique across the whole system, so if TRACES says it is already in use, the operator very likely exists already and you should ask to join it instead of creating a duplicate.
Step 3: send the authorisation request
When the operator form is complete, select Create a new operator at the top right. This does not create the operator outright; it opens a confirmation, because what you are really doing is sending an authorisation request to attach your EU Login to that operator. Add an optional message if you like, then send it. In production the request is checked before your role becomes active, so expect a short wait; in acceptance it is effectively immediate.
Step 4: activate web-service access and generate the authentication key
Once your operator role is active, open your TRACES profile. Near the bottom is a Web Services Access panel, which on a fresh account reads "No WS accesses". This is where the machine credential lives.
Create a web-service user in that panel. An Active control appears only once the operator role has fully propagated to the web-service layer, which can lag the role grant by a short while; if it is missing, wait and reload rather than recreating anything. Setting the access to Active reveals the authentication key. Copy the key and the web-service username immediately, because the key is displayed once and cannot be shown again. If you lose it, you regenerate, which invalidates the old one. Treat it like a password: it authenticates filings in your name.
If the Active control still does not appear once the operator role is fully active, web-service activation may need to be requested from the TRACES support team at [email protected].
Where the credentials go in plotvera
In plotvera, open Settings and paste the web-service username and the authentication key into the TRACES web-service credentials card, and pick the matching environment. The key is encrypted at rest and never shown back to you. This is the only step that needs it: checking plots against the EUDR geolocation requirements, validating a GeoJSON file, screening and generating document packs all work without any TRACES key at all. Whether you file in your own name or as an authorised representative for a mandating operator is a separate, per-statement choice; the credential only proves who is connecting.
Common problems
- The Active button never appears. The operator role has not propagated to the web-service layer yet. Wait, reload your profile, and confirm the role is active before expecting it.
- EORI already in use. Someone at your company likely registered the operator already. Request to join the existing operator instead of creating a second one.
- A key that works in testing fails in production. Acceptance and production are separate systems with separate credentials. Generate a key in the environment you actually file against.
- A statement is rejected for a missing EORI. The EORI belongs on the operator profile, not the statement. Fix the profile, then refile. The mechanics of a filing are covered in the DDS filing guide.
With the key saved you are ready to file when you choose to, which is exactly where the due diligence statement itself and your wider compliance checklist take over. Ready to file is a starting line, not a finish.