Skip to main content

Authentication

The Vidocu API supports two authentication methods:

  • API Keys — for server-to-server integrations you control
  • OAuth 2.0 — for third-party apps acting on behalf of users (learn more)

All API requests require a valid token passed in the Authorization header.

API Keys​

Header format​

Authorization: Bearer vdo_live_your_key_here

API key format​

Keys follow the format vdo_live_ followed by a random string. Example:

vdo_live_k7xG2mNpQrS9tVwY1zA3bC5dE

Managing keys​

API keys are available on the Business plan and above. Create and manage them from the Vidocu Dashboard. Each workspace can have up to 10 API keys.

Keys can be revoked at any time from the dashboard. Revoked keys are rejected immediately.

tip

Want to use Vidocu from Claude without an API key? The MCP integration authenticates with OAuth and works on any plan.

Security​

  • Keys are hashed (SHA-256) before storage — Vidocu never stores your raw key
  • Only the key prefix is visible in the dashboard after creation
  • Keep keys out of client-side code and version control
  • Rotate keys if you suspect they've been compromised

Error responses​

Missing or invalid keys return 401:

{
  "error": {
    "code": "authentication_error",
    "message": "Invalid or missing API key"
  }
}

Keys that don't start with vdo_live_ return:

{
  "error": {
    "code": "authentication_error",
    "message": "Invalid API key format"
  }
}

OAuth 2.0 access tokens​

OAuth access tokens (vdo_oat_*) work the same way as API keys in the Authorization header:

Authorization: Bearer vdo_oat_your_access_token

OAuth tokens are scoped — they can only access endpoints the user approved. See the OAuth 2.0 guide for setup instructions.