Setup & Maintain Vitu APIs

Overview

Vitu APIs use OAuth 2.0 to securely authenticate client applications and authorize access to protected resources. This approach ensures that only approved applications can access your subscribed APIs.

Client Credentials Flow

Most Vitu APIs use the Client Credentials Grant, which is ideal for server‑to‑server integrations.

1. Your application sends your client ID and client secret to Vitu’s authorization server.
2. Vitu returns an access token.
3. Your application includes the access token in API requests.
4. Vitu validates the token before processing each request.

Token Example

POST /oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=client_credentials
client_id=YOUR_CLIENT_ID
client_secret=YOUR_CLIENT_SECRET
audience=YOUR_API_AUDIENCE

Using the Access Token

Include the token in the Authorization header for all API requests:

Authorization: Bearer YOUR_ACCESS_TOKEN

Tokens are time‑limited for security and must be refreshed periodically.