> For the complete documentation index, see [llms.txt](https://docs.vida.id/identity-stack/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vida.id/identity-stack/verify/id-fraud-shield-sdk/integration-guide/ios/api-authentication.md).

# API Authentication

The partner, who is making the API requests, must include a specific type of header, called the "authorisation header", in each request they make. The header should contain a unique token, called a "bearer access token". This token serves as a form of authentication, verifying that the request is coming from a legitimate and authorised source.

## Prerequisites

<table><thead><tr><th width="144.5078125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td>client_id</td><td>A unique client id that is shared for each partner.</td></tr><tr><td>client_secret</td><td>A unique key that is auto-generated for each product configured for the partner.</td></tr></tbody></table>

{% hint style="info" %}
A **client ID** and **secret** are provided to each partner and are required in order to use the API. If you do not have a client ID and secret, please refer to the [getting API credentials](https://docs.vida.id/identity-stack/verify/liveness/integration/api/api-authentication#prerequisites) section for information on how to obtain them.
{% endhint %}

## API Responses

#### Access Token Generated

The input parameters are correct and an access token is generated.

HTTP Status Code: `200`

<details>

<summary>JSON Response</summary>

```json
{
    "access_token": "eyJhbGciOiJSb5J4ZTZ…",
    "expires_in": 18000,
    "refresh_expires_in": 1800,
    "token_type": "Bearer",
    "not-before-policy": 1621349762,
    "session_state": "98ffa630-af77-4312-b4b87fc",
    "scope": ""
}
```

</details>

#### Unauthorised - Invalid Credentials

The client secret key parameter or its value is either missing or incorrect. The partner must check the client's secret key before sending the request.

HTTP Status Code: `401`

<details>

<summary>JSON Response</summary>

```json
{
   "error": "unauthorized_client",
   "error_description": "INVALID_CREDENTIALS: Invalid client credentials"
}
```

</details>