Docs/Start/Authentication

Authentication

Exchange your API key and API secret for a temporary bearer token, then use that token for API requests.

Protect your Voyced access from the first test

Your API credentials can access customer information and the functions allowed for that key. Treat the API secret like a password. Store it only in protected server-side settings or a trusted secret store.

Never put an API key, API secret or bearer token in public code, browser JavaScript, screenshots, URLs or support messages.
Keep Sandbox and Live credentials separate. Give each integration only the permissions it needs.
Rotate the secret and disable the old key at once when exposure is suspected.

Read the security checklist

API key + API secretLong-term credentials

→

Bearer tokenTemporary access

→

API requestAuthorization header

1. Request a token

cURL

curl --request POST \
  --url 'https://sandbox.voycedconnect.eu/v1/auth/token' \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --data '{
    "api_key": "YOUR_SANDBOX_API_KEY",
    "api_secret": "YOUR_SANDBOX_API_SECRET"
  }'

PHP

<?php
$payload = json_encode([
    'api_key' => getenv('VOYCED_API_KEY'),
    'api_secret' => getenv('VOYCED_API_SECRET'),
]);
$curl = curl_init('https://sandbox.voycedconnect.eu/v1/auth/token');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Accept: application/json', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_TIMEOUT => 20,
]);
$response = curl_exec($curl);
if ($response === false) { throw new RuntimeException(curl_error($curl)); }
curl_close($curl);
echo $response;

Node.js

const response = await fetch('https://sandbox.voycedconnect.eu/v1/auth/token', {
  method: 'POST',
  headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
  body: JSON.stringify({
    api_key: process.env.VOYCED_API_KEY,
    api_secret: process.env.VOYCED_API_SECRET,
  }),
});
console.log(await response.json());

Python

import os
import requests
response = requests.post(
    "https://sandbox.voycedconnect.eu/v1/auth/token",
    json={
        "api_key": os.environ["VOYCED_API_KEY"],
        "api_secret": os.environ["VOYCED_API_SECRET"],
    },
    headers={"Accept": "application/json"},
    timeout=20,
)
response.raise_for_status()
print(response.json())

2. Use the token

Authorization header

Authorization: Bearer YOUR_BEARER_TOKEN

3. Renew it when needed

Use expires_in or expires_at from the token response. Request a new token before the current token expires. Do not keep retrying an expired token.

Keep secrets out of the browser

Do not place your API key or API secret in website JavaScript, mobile-app code, URLs, support messages or screenshots.

Credential rules

Store the API secret in protected server-side configuration.
Use separate credentials for Sandbox and Live.
Never send an API secret to an endpoint other than /auth/token.
Remove bearer tokens from logs and error reports.
Rotate credentials when exposure is suspected.