Authentication

All API calls to Vengtoo require authentication. Two methods are supported, and both are accepted on every endpoint:

• API keys: simple, non-expiring by default, ideal for internal scripts and trusted backends.
• OAuth2 Client Credentials: standards-compliant, short-lived tokens with scopes. Preferred for CI/CD, third-party integrations, and compliance-sensitive deployments. See OAuth2 Client Credentials.

Getting an API key

1. Sign in to the Vengtoo Console
2. Go to Settings → API Access
3. Click Create API Key
4. Copy the key and store it somewhere safe

The key is shown only once

The full API key is displayed only once, at creation. If you lose it, you cannot retrieve it: revoke the key and create a new one.

Using the API key

Pass the API key in the Authorization header:

Authorization: Bearer vgt_...

The same header format applies to OAuth2 access tokens: the server accepts either.

Base URL

https://api.vengtoo.com

Example

curl -X POST https://pdp.vengtoo.com/access/v1/evaluation \
  -H "Authorization: Bearer vgt_..." \
  -H "Content-Type: application/json" \
  -d '{
    "subject": { "id": "user-123", "type": "user" },
    "resource": { "id": "doc-456", "type": "document" },
    "action": { "name": "read" }
  }'

Key management

• API keys can be revoked or deleted from the Console at any time.
• Keys do not expire by default: set an optional expiration date when creating the key.
• Optionally restrict a key to specific IP addresses or CIDR ranges: requests from other IPs are rejected.