Access to API¶
Registering application¶
To obtain application credentials, you must contact Vend Support.
In the contact form, you will be asked basic questions about your application, including the type of software you are building. For example, whether your software will be used solely as an in-house solution or by external companies.
If your software is a product offered to dealerships, and if you want your customers to be able to seamlessly connect to Dealer Hub, your application can be listed in Dealer Hub under the “Trusted DMS Integration” section.
Note
Each dealer can select which applications are allowed to perform operations on their behalf.
Once your application is successfully registered, you will receive a unique pair of credentials: client_id and
client_secret via a secure channel.
These credentials are confidential and must not be shared.
Warning
If your client_id or client_secret is compromised, contact us immediately to generate a new credential pair and
deactivate the compromised one.
You are now ready to interact with the Token Endpoint.
Authorization¶
OAuth2 Client credentials¶
Currently, the only supported OAuth 2.0 flow is the Client Credentials grant, implemented in compliance with RFC.
The client may perform actions on behalf of a resource owner (dealer) when the scope of the client's privileges has been previously extended with the Dealer Hub Authorization Server. This extension can be performed by the resource owner ( dealer) by choosing the DMS of interest in the "Trusted DMS Integration" list. Some dealerships may contain multiple locations, and each of these locations must go through the same process to grant privileges.
Token caching and renewal¶
The access token (access_token) is valid for 30 minutes. A single client may issue up to 50 access tokens, all of which may remain valid simultaneously. This limitation is intended to prevent excessive load on the authorization server. For optimal interaction with the API, a single access token should be reused across requests and refreshed after half of its time-to-live (TTL) has elapsed. The token issuance limit is designed to support simple in-memory caching across all instances of the client application.
Token revocation¶
Refresh tokens are not supported by Client Credentials grant; therefore, only access tokens can be revoked. There are two scenarios in which client credentials may become invalid - fully or partially:
- Credential compromise:
If the client_id and client_secret pair is compromised, it must be revoked at the request of the integrating client.
In this case, all issued access tokens immediately become invalid, and no new tokens can be issued using the revoked
credentials.
- Removal from Trusted DMS Integration:
If a dealer removes a DMS from their Trusted DMS Integration list, existing access tokens remain technically valid. However, any attempt to access resources belonging to that dealer will result in a 403 Forbidden response.