Get started · Authentication

Create token

Exchanges your API key and secret for an access token. Send the token as Authorization: Bearer <token> on every other API call. The request has no body.

The access token is data.accessToken.token and lasts 30 minutes. The refresh token is data.accessToken.refreshToken and lasts 7 days: use it with Refresh token to get new access tokens without sending your secret again.

This endpoint allows 5 requests a minute from one IP address; more return 429. Keep the token and reuse it until it expires instead of creating one per call. A wrong key or secret returns 401.

Headers

x-api-key string Required

Your API key: vzm_ followed by 16 characters.

x-api-secret string Required

The secret shown once when you created the key.

Call this from your server only. Never put your API secret in a browser or an app, and never commit it to version control: keep it in an environment variable.