Quickstart

Exchange a server-side client credential for a short-lived access token, then call the Platform API with only the scope your operation requires.

Before you begin

You need a Vision-issued client ID and the client secret shown during creation. The secret is disclosed once and cannot be recovered later.

Request a token

Send form-encoded client credentials to the token endpoint. Tokens expire in no more than five minutes.

curl https://vision.ivisionstudios.com/oauth/token \
  --request POST \
  --header 'content-type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=vcr_your_client_id' \
  --data-urlencode 'client_secret=your_one_time_secret' \
  --data-urlencode 'scope=vision.apps:read'

{
  "access_token": "eyJ...",
  "token_type": "Bearer",
  "expires_in": 300,
  "scope": "vision.apps:read"
}

Call the Platform API

curl https://vision.ivisionstudios.com/platform/v1/apps \
  --header 'authorization: Bearer eyJ...' \
  --header 'accept: application/json'

Keep the x-request-id response header when investigating an error. Private responses use Cache-Control: no-store.

Production checklist

• Request only the scopes required for the current operation.
• Cache access tokens in server memory until shortly before expiry.
• Apply bounded connection and response timeouts.
• Retry only errors explicitly marked retryable.
• Rotate credentials deliberately and revoke them immediately after suspected exposure.
• Validate the exact issuer, audience, algorithm, key ID, workspace, App entitlement, and scope in resource servers.