Authentication

The partner, who is making the VIDA Sign API requests, must include a specific type of header, called the "authorisation header", in each request they make. The header should contain a unique token, called a "bearer access token". This token serves as a form of authentication, verifying that the request is coming from a legitimate and authorised source.

A client ID and Client Secret are required in order to use the Authentiction API.

A client ID and secret can be generated by the partner in the VIDA sign dashboard, please refer to the getting API credentials section on how to obtain them.

API Endpoint

POST https://{{environment_url}/core/api/rest/v1/oauth2/token

---

Headers

Name	Type	Description
Content-Type	string	Format type of request body application/x-www-form-urlencoded

---

Request Body

Name	Type	Description
grant_type*	String	Valid grant type for this method will be client_credentials
client_id*	String	An identifier of the client that is provided by Vida.
client_secret*	String	A secret is known only by the client and Vida authentication service.

---

Response

Access Token Generated

The input parameters are correct and an access token is generated.

HTTP Status Code: 200

JSON Response

{
    "access_token": "{access_token}",
    "token_type": "bearer",
    "expires_in": 899,
    "scope": "read write",
    "jti": "{jti}"
}

Unauthorised - Invalid Credentials

The client secret key parameter or its value is either missing or incorrect. The partner must check the client's secret key before sending the request.

HTTP Status Code: 401

JSON Response

{
    "error": "unauthorized_client",
    "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}

Bad Request - Invalid or Missing Parameter(s)

The client id parameter or its value is either missing or incorrect. The partner must check the client id before sending the request.

HTTP Status Code: 400

JSON Response

{
    "error": "unauthorized_client",
    "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}

Bad Request - Unsupported Grant Type

The grant type parameter or its value is either missing or incorrect.The partner must check the grant type before sending the request. Valid grant type: client_credentials.

HTTP Status Code: 400

JSON Response

{
    "error": "unsupported_grant_type",
    "error_description": "Unsupported grant_type"
}

Access Token Validity

Upon a successful API call, an access token and refresh token will be generated and sent in the response. The received JWT (JSON Web Token) token is required to authenticate all API requests for a limited time. Please refer to the below table for the access token validity period

Environment	Validity
Production	5 minutes
Sandbox	5 hours