> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vu-one.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authenticate with OAuth2 Client Credentials

> Get a Bearer token using your clientId and clientSecret to authenticate every Identity Link API call.

VU Identity Link uses OAuth2 client credentials flow. You exchange your `clientId` and `clientSecret` for a short-lived Bearer token, then include that token in the `Authorization` header of every subsequent API request.

## Where to find your credentials

Log in to the VU portal and call `GET /users/me` with a valid token. The response includes your `clientId`, `clientSecret`, and `webhookSecret`:

```json theme={null}
{
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "webhookSecret": "your-webhook-signing-secret"
}
```

<Warning>
  Treat `clientSecret` and `webhookSecret` as sensitive credentials. Never commit them to version control or expose them in client-side code.
</Warning>

## Request a token

Send a `POST` request to `/oauth/token` with the `Authorization: Basic` header containing `base64(clientId:clientSecret)`.

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST https://api.identity.vu-one.com/api/v1/oauth/token \
    -H "Authorization: Basic $(echo -n 'your-client-id:your-client-secret' | base64)" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "grant_type=client_credentials"
  ```

  ```js JavaScript theme={null}
  const credentials = btoa(`${clientId}:${clientSecret}`);

  const response = await fetch('https://api.identity.vu-one.com/api/v1/oauth/token', {
    method: 'POST',
    headers: {
      'Authorization': `Basic ${credentials}`,
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: 'grant_type=client_credentials',
  });

  const data = await response.json();
  console.log(data.access_token);
  ```

  ```python Python theme={null}
  import base64
  import requests

  credentials = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()

  response = requests.post(
      "https://api.identity.vu-one.com/api/v1/oauth/token",
      headers={
          "Authorization": f"Basic {credentials}",
          "Content-Type": "application/x-www-form-urlencoded",
      },
      data={"grant_type": "client_credentials"},
  )

  data = response.json()
  print(data["access_token"])
  ```
</CodeGroup>

## Token response

```json theme={null}
{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "expires_in": 3600,
  "token_type": "Bearer"
}
```

| Field | Type | Description |
| - | - | - |
| `access_token` | string | JWT token to use in subsequent requests. |
| `expires_in` | integer | Lifetime in seconds (always 3600). |
| `token_type` | string | Always `Bearer`. |

## Using the token

Include the token in the `Authorization` header of every protected endpoint:

```bash theme={null}
curl -X GET https://api.identity.vu-one.com/api/v1/links \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIs..."
```

<Tip>
  Cache the `access_token` and reuse it until it expires. Do not request a new token for every API call. A simple in-memory cache with a 3500-second TTL avoids unnecessary 401 errors and reduces latency.
</Tip>

## Common errors

| Status | Cause | Resolution |
| - | - | - |
| 401 | Expired or missing token. | Request a new token with `POST /oauth/token`. |
| 401 | Invalid `clientId` or `clientSecret`. | Verify credentials via `GET /users/me`. |
| 501 | Wrong `grant_type`. | Use only `client_credentials`. |

The full status-code reference lives on the [Errors](/en/identity-link/errors) page.

## Next steps

* Create your first verification link in the [Links](/en/identity-link/links) guide.
* Review the full list of authentication errors on the [Errors](/en/identity-link/errors) page.


## Related topics

- [Identity Link API Error Codes and Responses](/en/identity-link/errors.md)
- [Identity Link API: Integration Guide](/en/identity-link/introduction.md)
- [VU Technical Documentation](/en/index.md)
- [Integrate Connection Fingerprint](/en/vucs/connection-fingerprint/integration.md)
- [Quickstart: your first identity verification](/en/quickstart.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.