Required headers

Every request to api.vibe.co carries the same three headers and is gated by an OAuth scope.

Required headers

Header	Value	When
`Authorization`	`Bearer {access_token}`	Every request
`X-Vibe-Revision`	An ISO 8601 year-month, e.g. `2026-05`	Every request
`Content-Type`	`application/json`	Requests with a body

access_token is obtained via the OAuth token endpoint. For the full OAuth walkthrough, see Start your OAuth flow.

X-Vibe-Revision pins the request to a specific API revision. Hard-code your pinned value in production — see API Versioning and the Changelog for the list of published revisions.

Error responses

A request with no token or an expired token returns 401 Unauthorized. A request with a valid token that lacks the required scope returns 403 Forbidden.

Errors follow the standard Vibe error envelope:

{
  "error": {
    "type": "insufficient_scope",
    "title": "The token does not have the required scope.",
    "status": 403,
    "detail": {
      "required_scope": "campaigns:write",
      "granted_scopes": ["campaigns:read"]
    }
  }
}

[verify the actual envelope shape against a real 403 response before publishing]

Adding a scope after registration

Edit your app in My Applications → Authentication, request the additional scope, and resubmit for review. Issued tokens with the old scope set continue to work until expiry; tokens issued after approval carry the new scope.