---
title: "Authenticate with OAuth 2.0"
description: "Authenticate via OAuth 2.0 Client Credentials Grant: exchange a client ID/secret for a Bearer token, include it in the Authorization header."
url: "https://developer.vitu.com/api-catalog/production/setup-and-maintain/authentication-overview"
image: "https://developer.vitu.com/_og/d/c_Ocean.takumi,title_Authenticate+with+OAuth+2.0,description_~QXV0aGVudGljYXRlIHZpYSBPQXV0aCAyLjAgQ2xpZW50IENyZWRlbnRpYWxzIEdyYW50OiBleGNoYW5nZSBhIGNsaWVudCBJRC9zZWNyZXQgZm9yIGEgQmVhcmVyIHRva2VuLCBpbmNsdWRlIGl0IGluIHRoZSBBdXRob3JpemF0aW9uIGhlYWRlci4,props_eyJ0aGVtZSI6eyJtb2RlIjoiZGFyayIsImNvbG9ycyI6eyJwcmltYXJ5IjoiIzE3M2M0ZCJ9fX0,p_Ii9hcGktY2F0YWxvZy9wcm9kdWN0aW9uL3NldHVwLWFuZC1tYWludGFpbi9hdXRoZW50aWNhdGlvbi1vdmVydmlldyI,s_306xGqJa7uxYxQEE.png"
---

[Back to API Catalog](https://developer.vitu.com/api-catalog/sandbox)

# Authentication Overview

## [Overview](#overview)

Vitu APIs use OAuth 2.0 to securely authenticate client applications and authorize access to protected resources. This approach ensures that only approved applications can access your subscribed APIs.

## [Client Credentials Flow](#client-credentials-flow)

Most Vitu APIs use the Client Credentials Grant, which is ideal for server‑to‑server integrations.

### [How it Works](#how-it-works)

Your application sends your client ID and client secret to Vitu’s authorization server. Vitu returns an access token. Your application includes the access token in API requests. Vitu validates the token before processing each request.

## [Token Request Example (Conceptual)](#token-request-example-conceptual)

POST /oauth/token Content-Type: application/x-www-form-urlencoded

grant\_type=client\_credentials client\_id=YOUR\_CLIENT\_ID client\_secret=YOUR\_CLIENT\_SECRET scope=YOUR\_API\_SCOPE

## [Using the Access Token](#using-the-access-token)

Include the token in the Authorization header for all API requests: Authorization: Bearer YOUR\_ACCESS\_TOKEN Tokens are time‑limited for security and must be refreshed periodically.