Security

Connect your backend securely.

Your CMS backend uses a tenant token to call Vieunite. The editor’s browser uses its existing CMS login. Keeping those credentials separate lets you add artwork without exposing your tenant token.

Tenant server token

Store the token in a server environment variable or secret manager, then send it in the Bearer header. These integration examples use Test. Use a Test tenant token with this host, then switch the host and token together for Production.

authenticated requestcURL

curl --get "https://collection-test.vieunite.com/v1/artworks" \
  -H "Authorization: Bearer $VIEUNITE_TENANT_TOKEN" \
  -H "Accept: application/json" \
  -H "X-Request-ID: cms-request-01HRQ2" \
  --data-urlencode "limit=20"

Never place a persistent token in Browser JavaScriptHTMLlocalStorageURLsPicker messagesapplication logs

Scopes

Request only the scopes required by your integration. The exact requirement is displayed beside every operation in the tenant API reference.

Workflow	Typical scopes
Open the Picker and receive selections	`picker:create`, `picker:selection:redeem`
Custom catalogue UI	`artworks:read`, `collections:read`, `artists:read`, `categories:read`, `search:read`
Resolve saved selections or validate before publishing	`references:resolve`
Authenticated asset metadata	`assets:read`
Protected delivery	`assets:signed_url:create`
Local cache	`sync:read` and optionally `webhooks:manage`
Restricted content	Additional `safety:sensitive:read` or `rights:restricted:read` when approved

Picker security boundary

The Picker SDK calls two routes on your CMS: one creates a short-lived session and one redeems the completed selection. Neither route sends the tenant token back to the browser.

Editor is authenticatedBrowser requests a session from the CMS backend.

CMS creates the sessionBackend applies allowlisted options and its configured callback origin.

SDK opens the PickerThe temporary launch URL goes to the SDK; the selection code comes back through your redeem route.

CMS redeems onceBackend verifies session ownership and returns references containing the selected artwork IDs and rendition keys.

The SDK validates the exact Picker origin, source window, protocol version and active session before it accepts completion.

Origins and CSRF

An origin is the protocol, hostname and port, with no path: https://cms.example.com is an origin; https://cms.example.com/editor is not. Register each allowed origin with Vieunite, then set callback_origin from your backend configuration.

Require an authenticated CMS editor for both bridge endpoints.
Apply the CMS's normal CSRF protection.
Bind each Picker session to the editor, tenant and content entry.
Allowlist selection mode, resource types, filters and expiry on the server.
Avoid logging tenant tokens or short-lived capability values.

Idempotency

If redemption times out, your server may not know whether it succeeded. Retry with the same body and Idempotency-Key so Vieunite can return the saved result. Create the key once per Picker session and reuse it for every retry of that operation.

redemptioncURL

curl --request POST "https://collection-test.vieunite.com/v1/picker/selections/redeem" \
  -H "Authorization: Bearer $VIEUNITE_TENANT_TOKEN" \
  -H "Idempotency-Key: picker:pks_12345" \
  -H "Content-Type: application/json" \
  --data '{
  "session_id": "pks_12345",
  "selection_code": "one-time-selection-code"
}'

Do not assume every POST endpoint supports idempotency. Outbound webhooks also carry an idempotency key; webhook consumers should deduplicate on that value or event ID.

Environments and rotation

Keep test and live credentials in separate secret-manager entries and deploy them independently. A credential may be time-limited or revoked, so support overlapping credentials during rotation:

1
Issue the replacement credential with the same minimal scopes.
2
Deploy it to every CMS backend instance and verify live requests.
3
Revoke the old credential after propagation is complete.