Authentication

The vrtx closed-loop APIs use a secure API Key + Secret Key authentication model.
Your backend exchanges these credentials for a Bearer Access Token, which is then used to authenticate all API requests.

Overview

All vrtx API calls follow this flow:

Your backend sends client_id and client_secret to the Token Endpoint

vrtx returns a Bearer token

The Bearer token is used in every subsequent request

When it expires, generate a new one using the same credentials

Before You Start

Create an account on vrtx

A sandbox business is created for you with a developer access. Get your account!

Retrieve Your Credentials

From the vrtx dashboard, navigate to Developers → API Keys to obtain:

X-API-KEY

client_secret

Generate a Bearer Token

Call the /auth/token endpoint using your API credentials.

Store Token Securely

Save the access token on your server environment.

Authenticate All Requests

Send the token using:
Authorization: Bearer access_token

Authentication Model

🔐 Secure Access

The API Key and Secret Key authenticate your backend securely.

⏱ Short-Lived Tokens

Bearer tokens have a limited lifespan for improved security.

🔄 Easy Rotation

Rotate keys anytime from the vrtx developer dashboard.

Token Endpoint

vrtx uses a single endpoint to generate access tokens: Token

Item	Value
URL	`POST /v1/auth/token`
Authentication	`client_id` + `client_secret`
Token Type	`Bearer`
Expires In	Defined by system configuration (e.g. 3600 seconds)

Request

Response

{
  "access_token": "vrtx_at_93bf2d181ab",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Using the Token

Once generated, include the token in every API request:

Example: Get Wallets

Understanding Scopes

Scopes determine what your token is allowed to do inside the vrtx closed-loop ecosystem.

Scopes are always formatted as:

Read/Write Scope

If you include both scoping values, separate them with a space:

You can pass one or both scopes in the scope parameter.

Function	Read	Write
Fetch Data	✔️	✔️
Create / Update	❌	✔️
Financial Operations	❌	✔️

Be careful

Use the scope that fits your needs. In production, use read and write to achieve:

Full visibility

Execute operations

Best Practice for Choosing Scopes

Use Case	Recommended Scope
Dashboards / Reporting / Analytics	`closedloop.read`
Operational systems (wallet funding, payouts, cards)	`closedloop.write`
Full backend integration in production	`closedloop.read closedloop.write`
Third-party integrations	Least privilege (read only unless necessary)

Overview#

Before You Start#

Authentication Model#

Token Endpoint#

Request#

Response#

Using the Token#

Example: Get Wallets#

Understanding Scopes#

Best Practice for Choosing Scopes#

Overview

Before You Start

Authentication Model

Token Endpoint

Request

Response

Using the Token

Example: Get Wallets

Understanding Scopes

Best Practice for Choosing Scopes