Authentication

The VibeVO public API uses API keys. Every request must carry a valid key in a header. The key identifies the owner, and its scopes decide which endpoints are allowed.

Key format

A key looks like this:

vibevo_live_{prefix}.{secret}

• prefix — a short public identifier (visible in the cabinet, helps you recognize a key in the list).
• secret — the secret part. Shown only once at creation and never displayed again.

Creating a key

Keys are created in the cabinet on the Settings page — there is an "API keys" block at the bottom. When creating a key you:

1. give it a name (to tell keys apart);
2. select scopes — the set of permissions for this key;
3. optionally set an expiry;
4. copy the full key from the dialog — it is shown once.

Sending the key

Two equivalent headers are supported — use either one:

Authorization: Bearer vibevo_live_ab12cd.xxxxxxxxxxxxxxxx
X-API-Key: vibevo_live_ab12cd.xxxxxxxxxxxxxxxx

Scopes

Just two coarse scopes — you don't pick per-resource permissions:

• read — every GET (campaigns, offers, analytics, posts, creators, wallet, tracking links, factories). A key always has read.
• write — every mutation (content factories, video submission).

Authorization errors

• 401 Unauthorized — the key is missing, invalid, expired, or revoked.
• 403 Forbidden — the key is valid but lacks the scope required by this endpoint.

The error body format is described in the endpoint reference.

Updated: July 11, 2026