Vendy makes use of the JWT token because it is a secure, signed method for confirming a transaction or request. It allows you to initiate transactions, payout requests, etc.
A JSON Web Token, or JWT, is a string of characters that represents a secure way to encode and transmit data. When you generate a token, you can use it to authenticate yourself to a server or to prove that you are who you say you are.
There are two parts to a JWT:
-
Header: The header contains information about the token, such as the algorithm used to generate it.
-
Payload: the payload is the data that you want to encode.
To generate a token, you need both parts!

-
They're self-contained: All the information needed to verify the token is included in the token itself. This means that they can be passed around without needing to store anything else on the server.
-
They're tamper-proof: Once a token is generated, it cannot be modified without invalidating the signature. This makes them more secure than storing information in cookies, where it can be easily tampered with.
In order to generate a JWT token, you will need to use a library that supports the JSON Web Token standard. There are many such libraries available for various programming languages. Once you have chosen a library, you will need to import it into your project and configure it with your secret key. After that, you can use the library's methods to generate tokens.
-
Generate JWT token which allows you to initiate transactions, payouts requests,
-
Put in your header
-
Authorisation basic email/username and password
-
Auth is tied directly to your dashboard credentials.
What is Auth
The Auth Endpoint is the URL that Vendy uses to make an authenticated request to a resource server. The endpoint is typically "/auth".
When you make an authenticated request to a resource server, the resource server will use the Auth Endpoint to verify your identity and determine if you have the necessary permissions to access the requested resources.
Note!
- If you are authorised to access the requested resources, the resource server will return the requested information.
- If you are not authorised to access the requested resources, the resource server will return an error message.
How to call the Auth Endpoint
One of the most common API requests to handle is call the Auth Endpoint. This endpoint handles the API users and how they log in to Vendy. There are a few steps that need to happen before you can call this endpoint. Let's work through them together!
The Auth Endpoint is a simple HTTP POST request that requires two parameters: your App ID and your App Secret. These can be found in the Developers Console under your app's settings.
Once you have these, simply make a POST request to https://api.venmo.com/v1/oauth/authorize with the following parameters:
client_id: Your App ID
client_secret: Your App Secret
If successful, this request will return a JSON response with a access_token field. This token is required for all future requests to the Venmo API on behalf of your user.
What Happens when you call an Auth Endpoint
When you call the Auth endpoint, your request will be routed to the Auth0 authentication server. This server will then process your request and return a response.
If you are requesting an OAuth token, the response will include an access token, a refresh token, and an expiration time. The access token will allow you to make requests to OAuth-protected resources. The refresh token can be used to obtain new access tokens when the original expires. Finally, the expiration time is the length of time for which the access token is valid.
If you are requesting a SAML assertion, the response will include an XML document containing information about the authenticated user. This information can be used to generate a SAML response that can be sent to a SAML service provider.