Developers (MCP and API)
Create access tokens to connect an AI assistant (MCP) or your scripts (API) to the organization, choose their scopes and revoke them.
Access tokens connect an AI assistant (through the MCP server) or your own scripts (through the API) to the organization, with no password or cookie. Open Settings › Developers.
They take the Pro plan with the CRM option. Only owners and admins manage them.
Create a token
- Click Create a token.
- Name it after where it will be used, such as "Claude Desktop".
- Tick its scopes, under Read and Write.
- Choose when it expires: in 30 days, 90 days, a year, or never.
- Copy the token: it starts with
vt_pat_and won't be shown again. Keep it in a password manager.
Vintarget only keeps a fingerprint of it: no one, not even us, can show it to you again. If you lost it, revoke it and create another.
What a token can do
A token acts on your behalf, within its scopes, and never beyond what your role allows. If your role changes, it loses what you lose. If you leave the organization, it stops working.
| Scope | Allows |
|---|---|
stock:read | reading the stock |
stock:write | changing the stock |
purchases:read | reading purchases, the bot's included |
purchases:write | recording and changing purchases |
listings:read | reading listings |
listings:write | publishing and editing listings |
sales:read | reading sales |
sales:write | recording and changing sales |
analytics:read | reading analytics |
imports:write | importing files |
A token can never buy, pay, send a Vinted offer, change the filters or Auto Cop, or manage the members, billing, Vinted accounts or the organization.
Give a write scope only to a client you trust: it will change the organization's data on your behalf. Every change made through a token goes to the journal (Settings › Members), with the token and the client.
Revoke a token
Click Revoke next to the token, then confirm. It stops working at once. If an admin revokes your token, you are notified.
The list also shows each token's last use: revoke the ones no longer used.
For developers
Send the token in the Authorization header:
curl https://api.vintarget.fr/v1/me \
-H "Authorization: Bearer vt_pat_…"GET /v1/me returns the organization, the token and its scopes: enough to check your setup. The stock routes and the MCP server come next.
- Limits: 60 requests a minute per token, and a daily quota for the organization (10,000 with Pro and the CRM option). Beyond, the answer is
429with aRetry-Afterheader (in seconds). - Errors:
401 invalid_tokenfor a token missing, unknown, revoked or expired;403 insufficient_scopewhen a scope is missing;403 plan_requiredonce the plan no longer includes API access. - Request bodies are JSON. The API is not called from a browser: keep the token on a server or in your MCP client.