vlayer docsEnvironments and authentication
The production and staging hosts, how API tokens are issued, and how to send one with each request.
Hosts
| Environment | Base URL | Token prefix |
|---|---|---|
| Production | https://social-data-platform.eu.vlayer.xyz | sdp_ |
| Staging | https://social-data-platform.staging.eu.vlayer.xyz | sdp_test_ |
A token works only on the environment that issued it: a staging token is rejected by production with 401, and the other way round. Build and test against staging, then switch the base URL and the token together. The examples in these docs write the base URL as {API_BASE_URL}.
Usage on staging is counted separately from production.
Engagement verification customers are issued their own base URL with their credentials.
Get a token
Book a call (opens in a new tab) to get credentials. Tokens are issued per environment. Ask for more than one, for example one per service, if you want usage reported separately for each.
Your token can list your tokens with GET /auth/tokens and report their usage with GET /auth/usage. Creating, renaming and revoking tokens is done by us: ask on the same channel you got your credentials from. Tell us straight away if a token may have leaked, and we revoke it.
Keep tokens on your server
A token is a secret. Call the API from your backend and never ship a token in a browser or mobile app, where anyone can read it.
Send the token
Send the token as a Bearer token in the Authorization header of every request:
Authorization: Bearer sdp_...curl -G {API_BASE_URL}/v1/stats \
-H "Authorization: Bearer <API_TOKEN>" \
--data-urlencode "url=https://www.instagram.com/p/ABC123/"const params = new URLSearchParams({ url: "https://www.instagram.com/p/ABC123/" });
const res = await fetch(`${API_BASE_URL}/v1/stats?${params}`, {
headers: { Authorization: `Bearer ${API_TOKEN}` },
});The prefix only tells you which environment a token belongs to. Tokens issued before the prefixes were introduced keep working with a different prefix.
| Response | Meaning |
|---|---|
401 UNAUTHORIZED | The header is missing, or the token is unknown, expired or revoked |
403 CUSTOMER_SUSPENDED | Your account is suspended. Contact us |
A few engagement verification routes need a token with admin rights and return 403 otherwise: creating and advancing an attempt, redelivering an attempt's webhooks, and registering or disconnecting a creator's handle.
Request ids
Every response carries an X-Request-Id header. Quote it when you contact us about a request; see Get help with a request.
Last updated on