Both APIs use standard OAuth2 JWT bearer tokens, obtained via the `client_credentials` grant. All communication is over **HTTPS**.

## Get API access

Your **client ID**, **client secret**, **token issuer URL**, and **API audience identifier** are issued by your Aura Vision account manager. Treat the client secret like a password — never commit it to source control, never expose it in client-side code, and rotate it through your account manager if you suspect it has leaked.

## Request a token

`POST` to your issuer URL with the `client_credentials` grant. The exact issuer URL and audience identifier are provided with your credentials.

```http
POST /oauth/token HTTP/1.1
Host: <your-issuer>
Content-Type: application/json

{
  "client_id": "<your_client_id>",
  "client_secret": "<your_client_secret>",
  "audience": "<your_api_audience>",
  "grant_type": "client_credentials"
}
```

The response contains an `access_token` (JWT), a `token_type` of `Bearer`, and an `expires_in` (seconds). Cache the token until shortly before expiry — do not request a new one for every API call.

## Use the token (Core API)

Present the token on every request to the Core API:

```http
Authorization: Bearer <your_token>
Content-Type: application/json
```

## Use the token (Metrics API)

Connect to `wss://ws.auravision.ai?token=<your_token>` — present the token **once** at WebSocket connection time as a `?token=` query parameter. Do not include it on individual messages. The token is validated at connection; if it expires mid-session you’ll need to reconnect with a fresh one.

## Token lifetime

Tokens are short-lived (typically minutes to an hour). Build your client to refresh proactively rather than reacting to 401s. A reasonable pattern: refresh when the remaining lifetime drops below 25% of `expires_in`.