Authentication
The Developer Platform uses OAuth 2.0 client credentials for server-to-server integrations. Machine identities remain separate from employee accounts and browser sessions.
Machine identity
A client is bound to one organization, installation, environment, identity class, allowed Apps, and explicit scopes. The secret is stored by Vision only as a memory-hard verifier.
Access-token claims
Tokens use the vision-service-credential.v1 vocabulary and include standard JWT claims plus:
- Name
credential_version- Description
- Credential contract version.
- Name
vision_org_id- Description
- Issuing Vision organization.
- Name
app_workspace_ref- Description
Audience-specific workspace reference.
- Name
identity_class- Description
Shared human, service, agent, or worker class.
- Name
app_entitlements- Description
- Apps available to the token.
- Name
scope- Description
- Space-delimited, App-qualified scopes.
Tokens have an exact audience and expire in at most 300 seconds. Downstream App credentials carry exactly one App entitlement and one audience.
Public verification keys
Resource servers verify signatures from:
https://vision.ivisionstudios.com/.well-known/jwks.json
Pin the configured issuer, audience, algorithm, and key ID. Never accept keys from a token-controlled URL.
Credential lifecycle
Rotation creates a new credential version. Revocation is checked online at token exchange and Platform authorization, so a signed token alone does not override current client policy.