Authenticating to the webhook endpoint with oauth

This document describes the steps required to obtain an oauth access token and use it to authenticate your request to the webhook endpoint.

Getting the access token

To obtain an access token, you need to already have a client ID and client secret. You will craft a POST request and send it to the endpoint https://api.verticalinsure.com/v1/oauth/token like this:

{
    "grant_type": "client_credentials",
    "client_id": "test_****",
    "client_secret": "test_*********"
}

The response will come in a JSON object like this:

{
    "access_token": "***",
    "token_type": "Bearer",
    "expires_in": 3600
}

The value of access_token will be a JWT which you can use to authenticate to the webhook endpoint.

The get access token endpoint URL is the same for nonprod and production. Provide the test_ client credentials for nonprod environments and live_ client credentials for the prod environment.

Authenticating with the access token

To authenticate to the webhook endpoint, use the Bearer authentication scheme (provide an Authorization header with the value Bearer **** where the asterisks are replaced with the access_token you retrieved earlier).

We don't currently support 'refreshing' access tokens--for now, please just call the 'get access token' endpoint again as needed.