Function exchangeVantaToken

apps/sim/tools/vanta/utils.ts:176–211

(params: VantaTokenParams, cacheKey: string)

}

async function exchangeVantaToken(params: VantaTokenParams, cacheKey: string): Promise<string> {
  const response = await fetch(`${getVantaBaseUrl(params.region)}/oauth/token`, {
    method: 'POST',
    headers: {
      Accept: 'application/json',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      client_id: params.clientId,
      client_secret: params.clientSecret,
      scope: params.scope,
      grant_type: 'client_credentials',
    }),
    cache: 'no-store',
    signal: AbortSignal.timeout(VANTA_TOKEN_EXCHANGE_TIMEOUT_MS),
  })

  const data: unknown = await response.json().catch(() => null)
  if (!response.ok) {
    throw new Error(extractVantaError(data, 'Failed to authenticate with Vanta'))
  }

  if (!isRecordLike(data) || typeof data.access_token !== 'string') {
    throw new Error('Vanta authentication did not return an access token')
  }

  const expiresInMs = (getNumber(data.expires_in) ?? 0) * 1000
  if (expiresInMs > VANTA_TOKEN_EXPIRY_BUFFER_MS) {
    vantaTokenCache.set(cacheKey, {
      token: data.access_token,
      expiresAt: Date.now() + expiresInMs - VANTA_TOKEN_EXPIRY_BUFFER_MS,
    })
  }

  return data.access_token
}

/**
 * Returns a bearer token for the Vanta API, exchanging OAuth client