Skip to main content

Authentication

Every other endpoint requires an OAuth 2.0 Bearer token. Exchange your client_id and client_secret for an access token — server-side only — and reuse it until it expires.

Tips​

  • The token lifetime is in the response. data.expires_in is the number of seconds the token is valid for. Do not hardcode a lifetime; read it from each response.
  • Cache the token on your backend until shortly before expires_in elapses and refresh proactively. The token is a JWT, so you can also decode exp directly.
  • Errors. Rejected credentials return 401. A request missing client_id or client_secret returns 400.
  • Never put client_secret in the frontend. The client app should call your backend, which calls VOTR.
  • One environment per credential pair. Development and Production credentials are not interchangeable.
Loading playground…