Cardlytics · OAuth Scopes

Cardlytics OAuth Scopes

OAuth 2.0 searched

Cardlytics publishes 4 OAuth 2.0 scopes via the clientCredentials, authorizationCode, and custom flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Cardlytics API on a user’s behalf.

Tokens are issued from /v1/idp/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAdvertisingCommerce MediaCard-Linked OffersPurchase IntelligenceFinancial ServicesLoyalty and RewardsMarketingBankingRetail MediaAttributionOffers

Scopes: 4 Flows: clientCredentials, authorizationCode, custom Method: searched

OAuth endpoints

Authorization URL
https://advertiser-auth-preprod.auth.us-east-1.amazoncognito.com/oauth2/authorize

Token URL
/v1/idp/oauth2/token https://advertiser-auth-preprod.auth.us-east-1.amazoncognito.com/oauth2/token /v2/session/startSession

Flows
clientCredentialsauthorizationCodecustom

Scopes (4)

Scope	Description	Flows
openid	openid	authorizationCode, clientCredentials
read	Declared on Campaign Build API operation security requirements.
api:institution	Institution-level access. Create or update the institution's customer, account and card data, and send Cardlytics transaction information. Used for server-side Data API onboarding; no customer context required.	custom
api:customer	Customer-level access, on behalf of one end customer. Requires a sourceCustomerId on the startSession request. Grants targeted ad access, customer profile reads, and event logging for that customer's session.	custom

📄 Provider scope reference: https://docs.cardlytics.com/ads/v2/getting-started/get-session-token.html

Source

OAuth Scopes

generated: '2026-08-12'
method: searched
source: openapi/cardlytics-campaign-build-api-openapi.yml, openapi/cardlytics-partner-api-openapi.yml
docs: https://docs.cardlytics.com/ads/v2/getting-started/get-session-token.html
notes: >-
  Two scope vocabularies exist and they are unrelated. The OpenAPI-declared
  OAuth 2.0 schemes (partner API, campaign build API) declare only `openid`,
  which is an OIDC marker rather than a permission model — Cardlytics states
  that "API scopes" exist as an authorization control for partners but does not
  publish their names. The Publisher API v2 session token carries a genuine,
  documented two-scope model (api:institution, api:customer) requested in the
  startSession body and encoded into a `scope` claim.
schemes:
- name: oauth2
  source: openapi/cardlytics-partner-api-openapi.yml
  api: Partner API
  flows:
  - flow: clientCredentials
    tokenUrl: /v1/idp/oauth2/token
- name: oauth2-cognito
  source: openapi/cardlytics-campaign-build-api-openapi.yml
  api: Campaign Build API
  flows:
  - flow: authorizationCode
    authorizationUrl: https://advertiser-auth-preprod.auth.us-east-1.amazoncognito.com/oauth2/authorize
    tokenUrl: https://advertiser-auth-preprod.auth.us-east-1.amazoncognito.com/oauth2/token
- name: session-token
  source: https://docs.cardlytics.com/ads/v2/getting-started/get-session-token.html
  api: Publisher API v2
  flows:
  - flow: custom
    tokenUrl: /v2/session/startSession
    note: >-
      POST a JSON body with scopes[] (plus sourceCustomerId for customer-level
      scopes); the response returns a sessionToken sent on later calls as the
      X-CDLX-Session-Token header.
scopes:
- scope: openid
  description: openid
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - openapi/cardlytics-campaign-build-api-openapi.yml
  - openapi/cardlytics-partner-api-openapi.yml
- scope: read
  description: Declared on Campaign Build API operation security requirements.
  sources:
  - openapi/cardlytics-campaign-build-api-openapi.yml
- scope: api:institution
  description: >-
    Institution-level access. Create or update the institution's customer,
    account and card data, and send Cardlytics transaction information. Used for
    server-side Data API onboarding; no customer context required.
  apis:
  - Data APIs
  flows:
  - custom
  sources:
  - https://docs.cardlytics.com/ads/v2/getting-started/get-session-token.html
- scope: api:customer
  description: >-
    Customer-level access, on behalf of one end customer. Requires a
    sourceCustomerId on the startSession request. Grants targeted ad access,
    customer profile reads, and event logging for that customer's session.
  apis:
  - Ads
  - Customer Profile APIs
  - Events APIs
  flows:
  - custom
  sources:
  - https://docs.cardlytics.com/ads/v2/getting-started/get-session-token.html