Documentation Index

Fetch the complete documentation index at: /llms.txt

Use this file to discover all available pages before exploring further.

This guide describes OAuth App setup using the Authorization Code flow. If your application is a mobile app, single-page app (SPA), or other public client that cannot securely store a client secret, you must use the Authorization Code with PKCE instead.

Setting up an authorization code application

Step 1. Authorization Code Setup

Creating an authorization code app

Log in to the Criteo Partners Portal and create a new app by clicking the ➕ button in the My apps section.

This will open a modal where you can select type of application.

Create app

App details

• Provide your app name and description. Optionally, add an image to identify your application.
• On your app page, you can define the scope of your application and OAuth parameters. For more details, please refer to Getting connected to the API.

Authentication method

• Select your app’s authentication method: choose between “ Client Credentials” or “ Authorization Code”.
• For this setup, we are selecting “ Authorization Code”, but you can review our OAuth App implementation guide to determine the best option for your organization.

App activation

Service

Choose the Criteo service your API application will use: select C-Growth for Marketing Solutions or C-Max for Retail Media.

Authorizations

Domains

Choose the domains that define the permission access your application needs.

After completing these steps, click Activate app to activate the application.

Redirect URI

• For applications using the authorization code workflow, you need to specify a Redirect URI as part of your app scope.

Step 2. Set Up Your OAuth Parameters

After defining your application’s scope, set up the necessary parameters for the authorization code workflow.

You can now publish the app and initiate the authorization code workflow.

Consent URL Creation

Once your app parameters are set, you can implement the authorization code flow.

Consent URL

1. To request access, create a Consent link that redirects the user, using the following structure:

Authorization Code v. Client Credentials Consent URLs If you’re familiar with the Client Credentials workflow, you might notice that the Generate Consent URL button is not present in the partner portal for the authorization code workflow. This is because, with the authorization code method, you need to provide a redirect URI specific to your organization. Therefore, these URLs must be configured directly within your workflow.

You will need to construct a consent URL similar to the example below while passing the required parameters for your application:

URL

https://consent.criteo.com/request?response_type=code&client_id={client_id}&redirect_uri={redirect_uri}&state={state}

2. The consent link directs users to the Criteo Consent page, where they can select which advertisers to grant access to and approve the request.

Notes A consent request will not be displayed if:

• The client_id does not match a published API app.
• The redirect_uri is unauthorized.
• There is an unexpected backend error.

In any of the cases above an error message will be displayed.

Redirection and Access Code

Upon completing the Consent Delegation, users are redirected to a URL similar to the example below:

URL

https://www.yourdomain.com/?code=58f4cd15-8087-48af-bab7-bba06d2df1da&state=4lr4e

This URL is forged with the authorized redirect_uri and the following query parameters:

If consent is denied, the redirect will include an error query parameter instead of a code.

Step 3. Exchanging Access Code For Access Token

With an authorization code, you can request an access token via a POST request:

curl -L 'https://api.criteo.com/oauth2/token' \
-d 'client_id=<MY_CLIENT_ID>' \
-d 'client_secret=<MY_CLIENT_SECRET>' \
-d 'redirect_uri=<MY_URI>' \
-d 'code=<MY_CODE>' \
-d 'grant_type=authorization_code'

Example

curl -L 'https://api.criteo.com/oauth2/token?grant_type=authorization_code&client_id=<MY_CLIENT_ID>&client_secret=<MY_CLIENT_SECRET>&redirect_uri=<MY_URI>' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'client_id=<MY_CLIENT_ID>' \
-d 'client_secret=<MY_CLIENT_SECRET>' \
-d 'redirect_uri=<MY_URI>' \
-d 'code=<MY_CODE>' \
-d 'grant_type=authorization_code'

The response from Criteo API will be the following:

{
    "access_token": "eyJhbGciOixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "token_type": "Bearer",
    "refresh_token": "eyJhbGciOxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "expires_in": 900
}

Token Lifetime The refresh token will be revoked if the user changes roles or leaves the organization. The account must be re-authorized through the consent flow by a new administrator.

Using the refresh token

To renew an access token, use the following request:

curl -X POST https://api.criteo.com/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=refresh_token&code={code}&redirect_uri={redirect_uri}&client_id={client_id}&client_secret={client_secret}"

The response will be the same as when issuing an access token.

Demo

Below is a demo application code (index.js) in NodeJS using the Express JS framework:

JavaScript

var express = require('express');
var passport = require('passport');
var OAuth2Strategy = require('passport-oauth2').Strategy;
var app = express();
var port = 3000;

// Passport setup
passport.use(new OAuth2Strategy({
    clientID: 'CLIENT_ID', // Enter your client_id here
    clientSecret: 'CLIENT_SECRET', // Enter your client_secret here
    authorizationURL: 'https://consent.criteo.com/request',
    callbackURL: `http://localhost:${port}/criteo-auth/callback`,
    tokenURL: 'https://api.criteo.com/oauth2/token',
    state: 'togorot'
  },
  function(accessToken, refreshToken, profile, cb) {
    cb(null, { accessToken, refreshToken });
  }
));
app.use(passport.initialize());

// Route declarations
app.get('/', function(req, res) {
  res.send('<a href="/criteo-auth">Link my Criteo account!</a>');
});

app.get('/criteo-auth', passport.authenticate('oauth2'));

app.get('/criteo-auth/callback',
  passport.authenticate('oauth2', { session: false }),
  function(req, res) {
    res.send(`<div>Authentication successful!</div><div>Access token:</div><textarea>${req.user.accessToken}</textarea><div>Refresh token:</div><textarea>${req.user.refreshToken}</textarea>`);
  }
);

console.log(
  `OAuth test app started on http://localhost:${port}`
);
app.listen(port);

Package.json

{
    "name": "oauth-node",
    "version": "1.0.0",
    "description": "",
    "main": "index.js",
    "scripts": {
        "start": "node index.js"
    },
    "author": "",
    "license": "ISC",
    "dependencies": {
        "ejs": "^3.1.6",
        "express": "^4.17.1",
        "passport": "^0.4.1",
        "passport-oauth2": "^1.6.0"
    }
}

Run the demo

1. Run npm install,
2. Connect to the developer portal and create an app.
3. Create an “Authorization code” app.
4. Generate app credentials and enter the client_id and client_secret in index.js.
5. Register “ http://localhost:3000/criteo-auth/callback” as the redirect URI.
6. Run npm run start,
7. Open http://localhost:3000.

What if my client_id and client_secret are compromised? Delete the credentials in the App page and create new ones. Users will need to re-authorize access.

What’s next

• OAuth App – Authorization Code & PKCE Setup