Authentication

Protected participant operations in the VibeVO API use API keys. A request must carry a valid key in a header; the key identifies the owner, and its scopes decide which endpoints are allowed. The exception is the two guest creator-catalog GETs described below.

Key format

A key looks like this:

vibevo_live_{prefix}.{secret}

• prefix — a short public identifier (visible in the cabinet, helps you recognize a key in the list).
• secret — the secret part. Shown only once at creation and never displayed again.

Creating a key

Keys are created in the cabinet on the Settings page — there is an "API keys" block at the bottom. When creating a key you:

1. give it a name (to tell keys apart);
2. select scopes — the set of permissions for this key;
3. optionally set an expiry;
4. copy the full key from the dialog — it is shown once.

Sending the key

Two equivalent headers are supported — use either one:

Authorization: Bearer vibevo_live_ab12cd.xxxxxxxxxxxxxxxx
X-API-Key: vibevo_live_ab12cd.xxxxxxxxxxxxxxxx

Scopes

Just two coarse scopes — you don't pick per-resource permissions:

• read — every GET (campaigns, offers, analytics, posts, creators, wallet, tracking links, factories). A key always has read.
• write — every mutation (content factories, video submission).

Exception: guest placement catalog

Only GET /api/v1/creator-catalog and GET /api/v1/creator-pages/{publicId} work without an API key. They return the published safe projection and do not grant access to drafts or order operations.

Participant operations use /api/v1/public/. Reads require scope read; creating, changing, uploading, and confirming actions require scope write. Core also checks the current role, account/channel owner, and access to the specific order. Write does not grant staff access or replace read.

Authorization errors

• 401 Unauthorized — the key is missing, invalid, expired, or revoked.
• 403 Forbidden — the key is valid but lacks the scope required by this endpoint.

The error body format is described in the endpoint reference.

Updated: July 11, 2026