generated: '2026-08-02'
method: searched
source: https://docs.vizit.com/standards/authentication
docs: https://docs.vizit.com/standards/authentication
notes: 'Derived from the provider''s published Authentication standard page and the
  createToken operation reference. No downloadable OpenAPI document is served, so the
  securityScheme shapes below are transcribed from the published docs rather than
  parsed from a spec file.'
summary:
  types:
  - oauth2
  - http
  api_key_in: []
  oauth2_flows:
  - clientCredentials
  model: machine-to-machine (server-to-server) only
schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_url: https://ext.vizit.com/auth/token
  operation: createToken
  identity_provider: Auth0
  scopes: []
  scopes_documented: false
  audience: https://ext.vizit.com
  audience_note: The audience value is constant across production and every dev environment.
  required_parameters:
  - name: client_id
    description: Machine-to-machine client ID issued by Vizit.
  - name: client_secret
    description: Machine-to-machine client secret issued by Vizit.
  - name: audience
    description: Always https://ext.vizit.com.
  - name: organization
    description: Auth0 organization ID issued by Vizit during onboarding. Required because
      the Auth0 client grant uses organization_usage; require.
  - name: grant_type
    description: Must be client_credentials.
  sources:
  - https://docs.vizit.com/standards/authentication
  - https://docs.vizit.com/api/authentication/createToken
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: All protected /v1/** endpoints
  header: 'Authorization: Bearer <access_token>'
  sources:
  - https://docs.vizit.com/standards/authentication
token:
  lifetime_seconds: 86400
  lifetime_note: Returned as expires_in on the token response; documented example is 86400
    seconds (24 hours).
  caching_guidance: Cache the token until it expires rather than requesting one per API call.
  refresh_guidance: On a 401, request a fresh token and retry once.
  unauthenticated_endpoints:
  - POST /auth/token
credentials:
  issuance: Provisioned by Vizit per organization and per environment during onboarding.
  self_service: false
  environment_scoped: true
  environment_note: Production credentials work only against production; dev1 credentials
    only against dev1.
  handling_guidance:
  - Store client_secret only in secure server-side systems or a secrets manager.
  - Do not embed machine-to-machine credentials in browser apps, mobile apps, or any
    distributed client.
  - Treat client_secret as a long-lived secret and the access token as a short-lived credential.
x-evidence:
  fetched: '2026-08-02'
  urls:
  - url: https://docs.vizit.com/standards/authentication
    http_status: 200
  - url: https://docs.vizit.com/llms-full.txt
    http_status: 200