Vendor API auth, all of it server-to-server

Integrating with a vendor: POST credentials to /token, get an access token good for forty minutes, call the API with the bearer header, refresh when it expires. Most stacks reach for a "client library." Half of those lag the vendor's docs by a quarter.

You use one hoody-curl session id for the whole flow. The token POST returns a JSON body; you parse the access token and pass it as a bearer on subsequent calls, all under the same session id. Cookies the vendor sets ride along automatically. When the token expires, one more POST to /token with the refresh token returns a new one. The next call resumes.

No client library. No SDK lagging the vendor. No breaking changes from an npm update.

The integration is a session id and three POSTs.