Authenticate with Vincere's OAuth2 flow and read/search candidate records

Steps

1. Register your app in Vincere (Settings > App Store > API Authentication & Throttling) to get a client_id and register a redirect_uri. Vincere Identity runs at https://id.vincere.io in production.
2. Send the user to GET /oauth2/authorize on id.vincere.io with client_id, redirect_uri, response_type=code, and an optional state; Vincere redirects back with a short-lived authorization code (and your state echoed back).
3. Exchange the code at POST /oauth2/token (application/x-www-form-urlencoded) with grant_type=authorization_code, client_id, and code to receive access_token, refresh_token, and id_token (type Bearer, expires_in: 3600). The refresh_token is issued only once per code.
4. Call GET /oauth2/user on id.vincere.io with header id-token: <id_token> to get the authenticated user's tenant(s), each with a tenant-specific apiKey.
5. Call the REST API at https://<YOUR_TENANT>.vincere.io/api/v2/..., sending both id-token: <id_token> and x-api-key: <tenant apiKey> headers on every request — e.g. GET /api/v2/candidate/{id} for a single record, or GET /api/v2/candidate/search/?fl=id,name&q=... to search.
6. Refresh tokens before expires_in runs out by re-hitting /oauth2/token with grant_type=refresh_token; store the refresh_token server-side only.