Authentication

All Vionlabs APIs use OAuth 2.0 Client Credentials (machine-to-machine) authentication via Stytch.

Getting started

1. Create API keys

   Log in to app.vionlabs.com → Settings → API Keys. If your company doesn't use the Vionlabs app, contact support to obtain API credentials.

   When creating an API key, copy your Client ID and Client Secret immediately — the secret is only shown once.

2. Get an access token

   Exchange your Client ID and Client Secret for an access token using the Stytch OAuth2 endpoint:

   curl -X POST "https://api.stytch.com/v1/public/project-live-ad1e793c-f32e-485c-b5a0-144d5cf64be7/oauth2/token" \
     -H "Content-Type: application/json" \
     -d '{
       "client_id": "YOUR_CLIENT_ID",
       "client_secret": "YOUR_CLIENT_SECRET",
       "grant_type": "client_credentials"
     }'

   Use the shared Stytch project ID shown above. Replace YOUR_CLIENT_ID and YOUR_CLIENT_SECRET with the credentials from Settings → API Keys, or those provided by support. For test projects, use https://test.stytch.com instead of https://api.stytch.com.

   Response:

   {
     "access_token": "eyJhbGci...",
     "expires_in": 3600,
     "token_type": "bearer"
   }

   Access tokens are short-lived and expire after one hour. Cache the token and request a new one shortly before the expires_in time; a 401 Unauthorized response can indicate that a new token is needed sooner.

3. Make API calls

   Include the access token in the Authorization header on every API request:

   curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     "https://apis.prod.vionlabs.com/smartlists"

   Catalog, Result, and Tasks APIs require the access token and a catalog query parameter. API keys are granted at the organization level, and an organization can have multiple catalogs. The catalog parameter identifies which catalog an inventory_id refers to.

   curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     "https://apis.prod.vionlabs.com/catalog/assets?catalog=my_catalog"