Authentication

Every API call carries a bearer token. You get one by exchanging an API client (a client_id and client_secret) at the authentication API.

curl -s https://authentication-api.vyrolabs-staging.net/api-client/authenticate \
  -H 'Content-Type: application/json' \
  -d '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET"}'

{ "access_token": "eyJhbGciOi...", "token_type": "Bearer", "expires_in": 3600 }

Send it on every request:

Authorization: Bearer eyJhbGciOi...

• Tokens last 60 minutes (expires_in is in seconds). There is no refresh token: authenticate again.
• Cache the token and reuse it. Renew it a few minutes before it expires, not per request.
• The secret is shown once, when the client is created. Store it like a password. If it leaks, delete the client in the Dashboard and create a new one.

Use the authentication endpoint for your environment.

Two kinds of API client

	User client	App client
Who it is for	A dealer automating their own showroom	A partner reading many dealers’ stock (marketplaces, comparison sites)
Created by	A dealer owner or manager, in the Dashboard	Vyro, on request
Acts as	That team member, with their role	Your app, with the grants the dealer approved
Sees	Everything the team member can see in their showrooms	Only showrooms that installed your app, and only what the grants allow

User clients

A user client signs in as a team member. It can do exactly what that person can do in the Dashboard, in the showrooms they belong to, including reading enquiries, test drives and customers.

Create one in the Dashboard: Settings > Team, open the team member, then the API Clients tab. Only owners and managers can create clients, for themselves or for team members below them.

Least privilege

For an integration that only reads data, add a dedicated team member with the Reporting role (for example integrations@yourdealer.com) and create the client for them. Reporting is read-only. If the client’s role changes or its creator loses access, the client stops working.

App clients

An app client belongs to an app, not a person. Dealers install the app on their showroom and approve its grants, for example inventory:read to read stock. The token only sees showrooms that installed the app.

This is the right model for a marketplace or comparison site that shows stock from many dealers. Email support@vyro.co to register an app.

Roles

A token’s role decides which tables, columns and rows it can read. Role is in the token’s x-hasura-default-role claim.

Role	Typical use	Can read
showroom:owner, showroom:manager	Full dealer automation	Everything in their showrooms, and can write
showroom:support	Customer service tools	Customers, enquiries, test drives, trade-ins, stock
showroom:reporting	Reporting, BI, read-only feeds	As support, read-only
app	Partner apps	Stock in installed showrooms (with inventory:read), plus public data
public (no token)	Public storefront data	Published stock, showrooms, locations, forms

A field you can’t read is reported as field '…' not found in type, not as a permission error. If a query works in the explorer but not in your code, check which token each used.

Public access

Published stock, showrooms, locations and forms can be read without a token, the same way a showroom website does. Without a token, stocked_vehicles returns at most 500 rows, assets 100 and showrooms 1 per request. A larger limit is silently cut to the cap, so page with offset.

A token doesn’t add the public data to what its role can see: it replaces it. A team member’s token sees only their own showrooms, including unpublished stock, with no row caps. To read other dealers’ published stock with a token, use an app client that those dealers have installed.