Skip to content
Linra Omni Vendor Docs

Exchange a client ID and secret for a vendor access token

POST
/api/v1/vendor/auth/token
curl --request POST \
  --url https://api-omni.linra.net/api/v1/vendor/auth/token \
  --header 'Content-Type: application/json' \
  --data '{ "clientId": "vnd_9f8c2a1b4e6d4a7c9b0e3f2d1c8a5b6e", "clientSecret": "••••••••••••••••••••••••••••••••••••••••••••••" }'

The credential-exchange door. Anonymous — no bearer token is required (you don’t have one yet). Rate-limited independently of every other route (see the Rate limits section of the Vendor Integration Standard). Returns a JWT (audience vendor-api) valid for 5 minutes, carrying your credential’s granted capabilities — see Authentication & capabilities.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
clientId
required
string
clientSecret
required
string
Example
{
  "clientId": "vnd_9f8c2a1b4e6d4a7c9b0e3f2d1c8a5b6e",
  "clientSecret": "••••••••••••••••••••••••••••••••••••••••••••••"
}

Responses

Section titled “Responses”

200

Section titled “200”

A new access token.

Media typeapplication/json
object
state
required
string
payload
required
details
object
payload
required
object
accessToken
string
tokenType
string
expiresIn

Seconds until expiry — always 300 today.

integer
Example
{
  "state": "SUCCESS",
  "payload": {
    "tokenType": "Bearer",
    "expiresIn": 300
  }
}

401

Section titled “401”

Invalid client ID/secret, or an inactive vendor.

Media typeapplication/json
object
state
required
string
payload
details
object
Examples
{
  "state": "UNAUTHORIZED_INVALID_CREDENTIALS",
  "payload": null,
  "details": {}
}

429

Section titled “429”

Too many requests. Retry after the Retry-After header (seconds).

Media typeapplication/json
object
state
required
string
payload
details
object
Example
{
  "state": "NOT_FOUND_VENDOR_OFFER"
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before retrying.