Overview

Vimine is the membership platform for Italian APS and third-sector organisations. Every association has its members, its cards, its statuto (the bylaws); with the API a site or an app of the association, or for the association can use all of it without rebuilding anything.

What you can do

	How	With which credentials
Sign in with Vimine — members enter your site with their account	OAuth 2.1 + PKCE, sign-in and consent page on vimine.network	a public or native client (client_id only)
Member API — profile, card and verdict, membership request, statuto, connected apps	GET /v1/me, /v1/me/membership, … with the member’s token	the permissions the member granted
Server integrations — the association’s own systems read card statuses	client_credentials	a confidential client (client_id + client_secret)
Card verification — “is this card active right now?”, offline too	GET /v1/verify/{card_token}, Ed25519 public keys	none
Public profile and enrolment — branding, membership types, in-force statuto; enrolment form	GET /v1/aps/{slug}, embeddable enroll page	none

Concepts

• Association and slug. Every association has a slug (https://app.vimine.network/enroll/<slug>); clients belong to one association and the tokens they issue are valid for that one only.
• Client. An integration registered from the Developers console of the Vimine app: it has a kind (website, native app, server), an environment (Test or Production), redirect URIs, allowed origins and the permissions it may ask for. See Register a client.
• Permissions (scopes). What a token can do: profile:read, membership:read, membership:request, … The member sees and grants them on the consent page. Full table in Permissions, errors and limits.
• Tokens. The member’s access token lasts 10 minutes; the refresh token rotates on every use and lasts 30 days (14 of inactivity). A confidential client’s token lasts 1 hour. The SDK renews everything by itself.
• sub. The member identifier you see in tokens and in /v1/me (vms_…) is specific to your association: stable over time, different in every association, never an internal id.
• Verdict. What matters at the door: valid, expired, statuto_required (the statuto re-acceptance is overdue) or inactive.
• Card token. The digital card is a signed token (vmt_…) shown as a QR code, with a validity window; it rotates on every status change and every 90 days anyway.
• Sandbox. A twin association with synthetic members in every state, where test clients are active right away. See Sandbox and test clients.

Where things are

Sign-in, consent and sign-out pages	https://app.vimine.network/authorize, /oauth/logout
API	https://api.vimine.network/v1/… — OpenAPI document at /v1/openapi.json, discovery at /.well-known/oauth-authorization-server
Card public keys	https://api.vimine.network/.well-known/vimine-card-keys.json
SDK	@vimine/sdk on npm: @vimine/sdk (browser), @vimine/sdk/react, @vimine/sdk/server
For a coding assistant	https://developers.vimine.network/en/llms.txt: the index of the pages in Markdown, with the rules to follow; llms-full.txt everything in one file; every page in Markdown, /en/guides/sign-in/ → /en/guides/sign-in.md

Next steps

1. Register a client from the console.
2. Install the SDK.
3. Follow Sign in with Vimine, or Server integrations if you work on the association’s own systems.