diff --git a/simulator.py b/simulator.py
index 0832907f..d6225543 100644
--- a/simulator.py
+++ b/simulator.py
@@ -544,17 +544,16 @@ def publish_frost(sid: str, sensor: dict, field: str, value: float) -> bool:
 _or_token_cache = {"token": "", "expires": 0}
 
 def _get_or_token() -> str:
-    """Obtient un token OpenRemote avec cache (admin-cli pour écriture)."""
+    """Obtient un token OpenRemote via client credentials (service account)."""
     import time
     if _or_token_cache["token"] and _or_token_cache["expires"] > time.time() + 60:
         return _or_token_cache["token"]
     try:
-        # Utiliser admin-cli qui a directAccessGrantsEnabled
+        # Utiliser le client openremote avec client secret (service account)
         data = urllib.parse.urlencode({
-            "grant_type": "password",
-            "client_id": "admin-cli",
-            "username": OR_ADMIN_USER,
-            "password": OR_ADMIN_PASS,
+            "grant_type": "client_credentials",
+            "client_id": OR_CLIENT_ID,
+            "client_secret": OR_CLIENT_SECRET,
         }).encode()
         req = urllib.request.Request(OR_TOKEN_URL, data=data)
         with urllib.request.urlopen(req, timeout=5) as resp: