Authentication

The Vouchsafe API is protected by an access token, which identifies your team.

You must pass the token with every request as an Authorization header:

Authorization: Bearer <token>

Access tokens should be kept secret and never checked into front-end code.

If you don’t provide a proper access token, you’ll get 401 responses from the API.

Obtaining an access token

Once you’ve created a Vouchsafe dashboard team, go to API integration and create a live API secret.

Along with your client ID, you can use it with the [Authenticate endpoint] to get an access token.

Regenerating tokens

Each access token is good for 24 hours, and must then be regenerate.

This limits the damage if one is ever compromised.

Call Authenticate at any time to get a fresh token.

When experimenting, it’s totally fine to call Authenticate afresh every time you interact with the API, but in a production environment, you should store the access token in memory or a database, and implement logic to refresh it only when it expires.

[Our SDKs] handle this for you.

Sandbox secrets

[Sandbox mode] behaviour is controlled by the kind of secret (and therefore token) you use to call the API.

If you want stable test data, use sandbox. If you want to experiment with real functionality, use live.