Getting Started with OAuth

The Doppel V2 API uses OAuth 2.0 client credentials flow. This guide explains how to obtain and use access tokens.

Prerequisites

An organization admin or super admin can create a Client ID and Client Secret from the Version 2 tab on the API Settings page in Doppel Vision. Credentials are self-service, and each organization can have up to 10 clients.

Save the Client Secret when you create the client. It is shown only once and cannot be retrieved later.

1. Get an Access Token

Exchange your credentials for an access token by making a POST request to the Doppel token endpoint.

cURL

curl --request POST \
  --url "https://api.doppel.com/oauth/token" \
  --header "Content-Type: application/json" \
  --data '{
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "audience": "doppel-external",
    "grant_type": "client_credentials"
  }'

Python

import requests

response = requests.post(
    "https://api.doppel.com/oauth/token",
    json={
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET",
        "audience": "doppel-external",
        "grant_type": "client_credentials",
    },
)
data = response.json()
access_token = data["access_token"]

Node.js

const response = await fetch("https://api.doppel.com/oauth/token", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    client_id: "YOUR_CLIENT_ID",
    client_secret: "YOUR_CLIENT_SECRET",
    audience: "doppel-external",
    grant_type: "client_credentials",
  }),
});

const { access_token } = await response.json();

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", #gitleaks:allow
  "token_type": "Bearer",
  "expires_in": 86400
}

2. Use the Access Token

Include the token in the Authorization header for all API requests:

cURL

curl --request GET \
  --url "https://api.doppel.com/v2/brands" \
  --header "Authorization: Bearer <YOUR_ACCESS_TOKEN>"

Python

import requests

headers = {"Authorization": f"Bearer {access_token}"}
response = requests.get("https://api.doppel.com/v2/brands", headers=headers)

Node.js

const response = await fetch("https://api.doppel.com/v2/brands", {
  headers: { Authorization: `Bearer ${access_token}` },
});

Token Expiration

Access tokens expire after 24 hours (86400 seconds). When you receive a 401 Unauthorized response, request a new token using the same flow above.

Best Practices

Store tokens securely - Never commit tokens to version control
Refresh proactively - Request new tokens before expiration to avoid request failures
Use environment variables - Store your client credentials in environment variables, not in code