2. OAuth Token Operating Model

Use an OAuth token for backend access to your enrolled VPP fleet. For this integration, your backend obtains the token with the client-credentials grant. This gives your platform one clear operational credential for telemetry, dispatch, and offboarding, without creating a separate token lifecycle for each end user.

Topic	OAuth token model
Role	Authenticates your VPP platform for fleet management and control.
How to obtain it	Your backend requests it with the client-credentials grant, using the `client_id` and `client_secret` issued to your Client App.
Device access	Covers devices currently bound to the same `client_id`.
Lifecycle	Valid for 24 hours. Request a new OAuth token when the current one expires.
Offboarding	Use `POST /op/v0/vpp/oauth2/client/offboard` with an OAuth token to release a device from your VPP.

Recommended operating pattern
Keep the client_secret and OAuth token in your backend only. Reuse a valid token for API calls, request a replacement before or after expiry, and never expose either credential in a browser or mobile app.