Authentication

One client is one account

A token carries the account it was minted for, and the API rejects it against any other account. So the account is a constructor argument, not a per-call one: if you serve three accounts, construct three clients.

Cache them. A token lives on the instance, so a fresh client per request re-mints every time.

const pool = new Map<string, VimConnectBackendClient>();

function clientFor(accountId: string): VimConnectBackendClient {
  const existing = pool.get(accountId);
  if (existing) return existing;
  const client = new VimConnectBackendClient({ ...base, accountId });
  pool.set(accountId, client);
  return client;
}

Authenticating up front

You never have to: the first call mints a token on demand. Call authenticate() when an auth failure has to be distinguishable from an operation failure, because both arrive as a VimConnectError with a 400:

try {
  await client.authenticate();
} catch (error) {
  // the credentials are wrong, or your app is not installed on this account
  throw error;
}

// anything thrown past this point is about the operation, not the auth
const { data } = await client.api.patient.get({ id });

A refused mint means one of two things: the clientId / clientSecret pair is wrong, or the account has no active install of your app.

Keeping the secret a secret

clientSecret mints tokens for every account that has installed your app, and there is no rotation endpoint: rotating means issuing new credentials. Keep it in your server's secret store, never in a browser, a mobile app, or a repository.