REST API
The VDClip public API is a server-to-server REST interface under https://api.vdclip.com/v1. You authenticate with Authorization: Bearer <token>, where the token is either a VDClip API key (vdck_...) or an OAuth access token. Each credential is scoped to the resources you grant it.
The API has no CORS and rejects browser requests. Keep your vdck_... key on a server you control, never in client code. If it leaks, rotate it and contact contact@vdclip.com.
Base URL and versioning
- Base URL:
https://api.vdclip.com - REST surface: every endpoint is prefixed with
/v1, for examplehttps://api.vdclip.com/v1/projects. - OAuth surface: the OAuth 2.1 server lives under
/oauth2/*and/.well-known/*. Those endpoints follow the relevant RFCs. See Authentication.
Authentication
Send your API key in the Authorization header as a Bearer token on every /v1 request.
curl https://api.vdclip.com/v1/account \
-H 'Authorization: Bearer vdck_your_key_here'API keys carry a fixed set of scopes and draw from your credit balance. For clients acting on behalf of a user, use OAuth 2.1 with a Bearer token instead; see OAuth 2.1.
Responses
Successful /v1 endpoints return the resource directly as JSON. Errors return an errors array. Include X-Request-ID and X-Trace-ID response headers when you contact contact@vdclip.com.
{
"errors": [
{
"code": "INSUFFICIENT_CREDITS",
"description": "Your account does not have enough credits for this operation."
}
]
}Error codes
| Code | Meaning |
|---|---|
INVALID_API_KEY | The Authorization header is missing, malformed, or not recognized. |
MISSING_SCOPE | The key is valid but lacks the scope required by the endpoint. |
INSUFFICIENT_CREDITS | The account does not have enough credits for the operation. |
RATE_LIMITED | Too many requests. Returned with HTTP 429 and a Retry-After header. |
UPSTREAM_ERROR | A downstream service failed. Safe to retry with backoff. |
VALIDATION_ERROR | The request body or query parameters failed validation. |
INVALID_JSON | The request body could not be parsed as JSON. |
NOT_FOUND | The requested resource does not exist or is not visible to this key. |
ORIGIN_REJECTED | The request came from a browser or disallowed origin. |
On RATE_LIMITED the API returns HTTP 429 with a Retry-After header telling you how many seconds to wait. Honor it and use exponential backoff. Plan limits are on the pricing page .
Pagination
List endpoints use cursor pagination: limit sets the page size, and cursor is an opaque token from the previous page (do not parse or build it yourself). Defaults and maximums vary per endpoint and are defined in the OpenAPI spec.
# First page
curl 'https://api.vdclip.com/v1/projects?limit=20' \
-H 'Authorization: Bearer vdck_your_key_here'
# Next page, using the cursor from the previous response
curl 'https://api.vdclip.com/v1/projects?limit=20&cursor=eyJpZCI6IjEyMyJ9' \
-H 'Authorization: Bearer vdck_your_key_here'Idempotency
POST /v1/projects supports the Idempotency-Key header (max 200 chars). Send
the same key on retry and the API replays the original response without creating
a duplicate project. Use a unique value per operation; UUIDs work well.
curl -X POST https://api.vdclip.com/v1/projects \
-H "Authorization: Bearer vdck_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000" \
-d '{ ... }'Scopes
Scopes follow the pattern vdclip:<resource>:<action>. There are 15. A request without the scope an endpoint requires fails with MISSING_SCOPE. Two scopes are plan-gated: vdclip:render:execute and vdclip:social:publish require a plan that includes them. See the pricing page .
| Resource | Scope | Grants |
|---|---|---|
| Account | vdclip:account:read | Read account profile, plan, and credit balance. |
| Projects | vdclip:projects:read | List and read projects, clips, and share links. |
| Projects | vdclip:projects:write | Create and delete projects and manage share links. |
| Results | vdclip:results:read | Read clip detail. |
| Results | vdclip:results:write | Like and dislike clips. |
| Render | vdclip:render:execute | Start renders and read render status. Plan gated. |
| Social | vdclip:social:read | List connected social accounts. |
| Social | vdclip:social:publish | Publish or schedule clips. Plan gated. |
| Calendar | vdclip:calendar:read | List scheduled and posted content. |
| Calendar | vdclip:calendar:write | Reschedule, update, and cancel scheduled posts. |
| Templates | vdclip:templates:read | List and read templates. |
| Templates | vdclip:templates:write | Create, update, and delete templates. |
| Assets | vdclip:assets:read | List and read brand kit assets. |
| Assets | vdclip:assets:write | Manage brand kit vocabulary and censored-word lists. |
Endpoint reference
All /v1 endpoints, grouped by resource. Full schemas and request bodies are generated from the OpenAPI spec.
Account
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/account | vdclip:account:read | Get account profile and plan |
GET | /v1/credits | vdclip:account:read | Get credit balance |
Projects
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/projects | vdclip:projects:read | List projects |
POST | /v1/projects | vdclip:projects:write | Create a clipping/captions project |
GET | /v1/projects/{project_id} | vdclip:projects:read | Get project status and detail |
DELETE | /v1/projects/{project_id} | vdclip:projects:write | Delete a project |
GET | /v1/projects/{project_id}/clips | vdclip:projects:read | List the clips a project produced |
GET | /v1/projects/{project_id}/share | vdclip:projects:read | Get the project share link |
POST | /v1/projects/{project_id}/share | vdclip:projects:write | Create a project share link |
POST | /v1/projects/{project_id}/share/regenerate | vdclip:projects:write | Regenerate the project share link |
DELETE | /v1/projects/{project_id}/share | vdclip:projects:write | Delete the project share link |
Clips
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/clips/{clip_id} | vdclip:results:read | Get clip detail |
POST | /v1/clips/{clip_id}/like | vdclip:results:write | Like a clip |
POST | /v1/clips/{clip_id}/dislike | vdclip:results:write | Dislike a clip |
POST | /v1/clips/{clip_id}/renders | vdclip:render:execute | Start a render |
GET | /v1/clips/{clip_id}/renders/latest | vdclip:render:execute | Get the latest render status |
POST | /v1/clips/{clip_id}/publish | vdclip:social:publish | Publish or schedule a clip |
Templates
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/templates | vdclip:templates:read | List templates |
POST | /v1/templates | vdclip:templates:write | Create a template |
GET | /v1/templates/{template_id} | vdclip:templates:read | Get a template |
PATCH | /v1/templates/{template_id} | vdclip:templates:write | Update a template |
DELETE | /v1/templates/{template_id} | vdclip:templates:write | Delete a template |
Assets
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/assets | vdclip:assets:read | List brand kit assets |
GET | /v1/assets/{asset_id} | vdclip:assets:read | Get a brand kit asset |
Calendar
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/calendar | vdclip:calendar:read | List scheduled/posted content |
PATCH | /v1/calendar/{post_id} | vdclip:calendar:write | Reschedule/update a scheduled post |
DELETE | /v1/calendar/{post_id} | vdclip:calendar:write | Cancel a scheduled post |
Social
| Method | Path | Scope | Summary |
|---|---|---|---|
GET | /v1/social-accounts | vdclip:social:read | List connected social accounts |
OAuth 2.1 for user-delegated clients
For MCP servers, AI agents, and integrations acting on behalf of a user, VDClip runs an OAuth 2.1 Authorization Server (issuer https://api.vdclip.com). These clients send Authorization: Bearer <JWT> instead of an API key.
The OAuth 2.1 endpoints use standard RFC request and response bodies, not the /v1 errors array. Handle their responses and errors separately.
| Method | Path | Summary |
|---|---|---|
GET | /.well-known/oauth-authorization-server | Authorization Server metadata (RFC 8414) |
GET | /.well-known/jwks.json | JWKS, the ES256 public signing keys |
POST | /oauth2/application | Dynamic Client Registration (RFC 7591) |
GET | /oauth2/application/{client_id} | Read client registration (RFC 7592) |
POST | /oauth2/token | Token endpoint, authorization code and refresh |
POST | /oauth2/revoke | Token revocation (RFC 7009) |
Related pages
Tips & Best Practices
The API has no CORS. Store vdck_ keys in server environment variables, never in browser or mobile client code.
A narrowly scoped key limits the blast radius if it is ever exposed.
Log it on every call so support can trace a specific request when you reach contact@vdclip.com.
On a 429, wait the seconds in the Retry-After header and use exponential backoff for repeated failures.
Treat the pagination cursor as opaque. Pass back exactly what the previous response returned.