Authenticate with OAuth2 Client Credentials

VU Identity Link uses OAuth2 client credentials flow. You exchange your clientId and clientSecret for a short-lived Bearer token, then include that token in the Authorization header of every subsequent API request.

Where to find your credentials

Log in to the VU portal and call GET /users/me with a valid token. The response includes your clientId, clientSecret, and webhookSecret:

{
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "webhookSecret": "your-webhook-signing-secret"
}

Treat clientSecret and webhookSecret as sensitive credentials. Never commit them to version control or expose them in client-side code.

Request a token

Send a POST request to /oauth/token with the Authorization: Basic header containing base64(clientId:clientSecret).

curl -X POST https://api.identity.vu-one.com/api/v1/oauth/token \
  -H "Authorization: Basic $(echo -n 'your-client-id:your-client-secret' | base64)" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

const credentials = btoa(`${clientId}:${clientSecret}`);

const response = await fetch('https://api.identity.vu-one.com/api/v1/oauth/token', {
  method: 'POST',
  headers: {
    'Authorization': `Basic ${credentials}`,
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: 'grant_type=client_credentials',
});

const data = await response.json();
console.log(data.access_token);

import base64
import requests

credentials = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()

response = requests.post(
    "https://api.identity.vu-one.com/api/v1/oauth/token",
    headers={
        "Authorization": f"Basic {credentials}",
        "Content-Type": "application/x-www-form-urlencoded",
    },
    data={"grant_type": "client_credentials"},
)

data = response.json()
print(data["access_token"])

Token response

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Field	Type	Description
`access_token`	string	JWT token to use in subsequent requests.
`expires_in`	integer	Lifetime in seconds (always 3600).
`token_type`	string	Always `Bearer`.

Using the token

Include the token in the Authorization header of every protected endpoint:

curl -X GET https://api.identity.vu-one.com/api/v1/links \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."

Cache the access_token and reuse it until it expires. Do not request a new token for every API call. A simple in-memory cache with a 3500-second TTL avoids unnecessary 401 errors and reduces latency.

Common errors

Status	Cause	Resolution
401	Expired or missing token.	Request a new token with `POST /oauth/token`.
401	Invalid `clientId` or `clientSecret`.	Verify credentials via `GET /users/me`.
501	Wrong `grant_type`.	Use only `client_credentials`.

The full status-code reference lives on the Errors page.

Next steps

Create your first verification link in the Links guide.
Review the full list of authentication errors on the Errors page.

Getting Started

Core Concepts

Reference

Authenticate with OAuth2 Client Credentials

Where to find your credentials

Request a token

Token response

Using the token

Common errors

Next steps

​Where to find your credentials

​Request a token

​Token response

​Using the token

​Common errors

​Next steps

Where to find your credentials

Request a token

Token response

Using the token

Common errors

Next steps