Vitu APIs use OAuth 2.0 to securely authenticate client applications and authorize access to protected resources. This approach ensures that only approved applications can access your subscribed APIs.
Most Vitu APIs use the Client Credentials Grant, which is ideal for server‑to‑server integrations.
- Your application sends your client ID and client secret to Vitu’s authorization server.
- Vitu returns an access token.
- Your application includes the access token in API requests.
- Vitu validates the token before processing each request.
Secure Local Storage: Securely cache the access token in memory or a fast-access data store (e.g., Redis).
Track Expiration: Inspect the expires_in attribute from the initial JSON response or decode the JWT payload to read the expiration timestamp.
Proactive Renewal: Request a new token only when the cached token is about to expire (e.g., 30–60 seconds before expiration).
Handle 401 Unauthorized: Ensure your client can clear the cache and fetch a fresh token immediately if a request fails with an unauthorized status, even if the local timer has not expired.
POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials
client_id=YOUR_CLIENT_ID
client_secret=YOUR_CLIENT_SECRET
scope=YOUR_API_SCOPE
Include the token in the Authorization header for all API requests:
Authorization: Bearer YOUR_ACCESS_TOKEN
Tokens are time‑limited for security and must be refreshed periodically.
To ensure optimal performance and avoid rate limiting, API integrators must cache the access tokens obtained via the Client Credentials grant.
Do not call the token endpoint for every individual API request. Instead, implement a local caching strategy within your application that reuses the current token until it approaches expiration.