> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/sign/digital-signature/vsp-openapi/api-reference/authentication.md).

# Authentication

The partner, who is making the VIDA Sign API requests, must include a specific type of header, called the "authorisation header", in each request they make. The header should contain a unique token, called a "bearer access token". This token serves as a form of authentication, verifying that the request is coming from a legitimate and authorised source.

A client ID and Client Secret are required in order to use the Authentiction API.

{% hint style="info" %}
A **client ID** and **secret** can be generated by the partner in the VIDA sign dashboard, please refer to the getting API credentials section on how to obtain them.
{% endhint %}

### API Endpoint

<mark style="color:green;">`POST`</mark>` ``https://{{environment_url}/core/api/rest/v1/oauth2/token`

***

### Headers

| Name         | Type   | Description                                                                              |
| ------------ | ------ | ---------------------------------------------------------------------------------------- |
| Content-Type | string | <p>Format type of request body<br><br><code>application/x-www-form-urlencoded</code></p> |

***

### Request Body

| Name                                             | Type   | Description                                                           |
| ------------------------------------------------ | ------ | --------------------------------------------------------------------- |
| grant\_type<mark style="color:red;">\*</mark>    | String | Valid grant type for this method will be `client_credentials`         |
| client\_id<mark style="color:red;">\*</mark>     | String | An identifier of the client that is provided by Vida.                 |
| client\_secret<mark style="color:red;">\*</mark> | String | A secret is known only by the client and Vida authentication service. |

***

### Response

#### Access Token Generated

The input parameters are correct and an access token is generated.

HTTP Status Code: `200`

**JSON Response**

```json
{
    "access_token": "{access_token}",
    "token_type": "bearer",
    "expires_in": 899,
    "scope": "read write",
    "jti": "{jti}"
}
```

#### Unauthorised - Invalid Credentials

The client secret key parameter or its value is either missing or incorrect. The partner must check the client's secret key before sending the request.

HTTP Status Code: `401`

**JSON Response**

```json
{
    "error": "unauthorized_client",
    "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}
```

#### Bad Request - Invalid or Missing Parameter(s)

The client id parameter or its value is either missing or incorrect. The partner must check the client id before sending the request.

HTTP Status Code: `400`

**JSON Response**

```json
{
    "error": "unauthorized_client",
    "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}
```

#### Bad Request - Unsupported Grant Type

The grant type parameter or its value is either missing or incorrect.The partner must check the grant type before sending the request. Valid grant type: client\_credentials.

HTTP Status Code: `400`

**JSON Response**

```json
{
    "error": "unsupported_grant_type",
    "error_description": "Unsupported grant_type"
}
```

### Access Token Validity

Upon a successful API call, an access token and refresh token will be generated and sent in the response. The received JWT (JSON Web Token) token is required to authenticate all API requests for a limited time. Please refer to the below table for the access token validity period

| Environment | Validity  |
| ----------- | --------- |
| Production  | 5 minutes |
| Sandbox     | 5 hours   |