Criteo · OAuth Scopes

Criteo OAuth Scopes

OAuth 2.0 searched

Criteo publishes 22 OAuth 2.0 scopes via the clientCredentials and authorizationCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Criteo API on a user’s behalf.

Tokens are issued from https://api.criteo.com/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

AdvertisingAgent SkillsAnalyticsAudiencesCampaignsCatalogCommerceCommerce MediaDisplay AdvertisingMarketingMCPMediaAuthenticationOpenAPIReportingRetailRetail MediaSponsored Products

Scopes: 22 Flows: clientCredentials, authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://api.criteo.com/oauth2

Token URL
https://api.criteo.com/oauth2/token

Flows
clientCredentialsauthorizationCode

Scopes (22)

Scope	Description	Flows
RetailMedia_Accounts_Read	Read accounts, their properties and parent/child relationships.
RetailMedia_Accounts_Manage	Create and modify accounts, add/remove brands, create child brand accounts under a Private Market parent.
RetailMedia_Campaign_Read	Read campaigns, line items, keywords, promoted products and targeting.
RetailMedia_Campaign_Manage	Create and modify campaigns, auction and preferred line items, keywords, promoted products and targeting.
RetailMedia_Audience_Read	Read audiences and audience segments available to campaigns.
RetailMedia_Audience_Manage	Create and modify audiences, audience segments and contact lists.
RetailMedia_Balance_Read	Read balance entities and the spending limits they define.
RetailMedia_Balance_Manage	Create balances, add funds, change balance dates and attach campaigns to a balance.
RetailMedia_Analytics_Read	Request and retrieve campaign, line-item, revenue, fill-rate, attributed-transaction and real-time performance reports.
RetailMedia_Billing_Read	Request and retrieve partner billing reports.
RetailMedia_Catalog_Manage	Request a retailer catalog build and retrieve its status and streamed output.
MarketingSolutions_Campaign_Read	Read campaigns, ad sets, budgets and Marketplace Performance Outcomes entities.
MarketingSolutions_Campaign_Manage	Create and modify campaigns, ad sets, budgets, bids and MPO seller activation.
MarketingSolutions_Audience_Read	Read audiences and audience segments and compute or estimate their sizes.
MarketingSolutions_Audience_Manage	Create and modify audiences and segments, and add/remove contact-list members.
MarketingSolutions_Creative_Read	Read creatives, ads, assets and coupons.
MarketingSolutions_Creative_Manage	Create and modify creatives, ads, assets and coupons.
MarketingSolutions_Analytics_Read	Request and retrieve advertiser and campaign performance reports.
MarketingSolutions_Reco_Read	Read product recommendation configuration and product sets.
MarketingSolutions_Reco_Manage	Create and modify product recommendation configuration and product sets.
CommerceGrid_Segment_Read	Read Commerce Grid audience segments.
CommerceGrid_Segment_Manage	Create and modify Commerce Grid audience segments.

📄 Provider scope reference: https://developers.criteo.com/criteo-apis/docs/create-your-app

Source

OAuth Scopes

generated: '2026-08-13'
method: searched
source: openapi/criteo-retail-media-api-openapi.yml, openapi/criteo-marketing-solutions-api-openapi.yml, openapi/criteo-commerce-grid-api-openapi.yml
docs: https://developers.criteo.com/criteo-apis/docs/create-your-app
supersedes: >-
  The previous version of this file listed Criteo's developer-portal "domains" (Accounts,
  Analytics, Audiences, ...) because the only spec in the repo was a hand-authored scaffold
  whose oauth2 flows declared an empty scopes map. Criteo's REAL published OpenAPI, harvested
  2026-08-13 from https://api.criteo.com/2026-07/{service}/open-api-specifications.json,
  carries the actual scope STRINGS on every operation's security requirement. Those 22
  strings are recorded below. The portal domains are retained as `authorization_model`
  because that is genuinely how a developer grants them — the domain is what you toggle in
  the app UI, the scope string is what arrives in the token.

authorization_model:
  docs: https://developers.criteo.com/criteo-apis/docs/create-your-app
  description: >-
    Criteo does not accept a `scope` parameter in the token request. Permissions are bound to
    the API application: when you create an app in the developer portal you pick a service
    (Retail Media / Marketing Solutions / Commerce Grid) and set each functional DOMAIN to an
    authorization level of No access, Read, or Manage. The resulting token silently carries
    the corresponding `<Service>_<Domain>_<Level>` scopes. An agent cannot widen its own
    grant at runtime; widening requires an app change and, for Authorization Code apps, a
    fresh consent from the account owner at https://consent.criteo.com/request.
  levels: [No access, Read, Manage]
  level_note: >-
    Manage implies Read. On the Retail Media Accounts domain, Manage additionally requires
    prior activation by a Criteo contact.

schemes:
- name: oauth
  source: openapi/criteo-retail-media-api-openapi.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.criteo.com/oauth2/token
  - flow: authorizationCode
    authorizationUrl: https://api.criteo.com/oauth2
    tokenUrl: https://api.criteo.com/oauth2/token
  note: >-
    The spec's declared flow `scopes` maps are empty ({}) in all three services; the scope
    strings appear only on per-operation `security` requirements. A generic OAuth client
    reading only components.securitySchemes will therefore see zero scopes — this is a real
    spec-quality gap worth reporting to Criteo.

scopes:
# ---- Retail Media (12) ----
- scope: RetailMedia_Accounts_Read
  domain: Accounts
  service: Retail Media
  level: Read
  description: Read accounts, their properties and parent/child relationships.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Accounts_Manage
  domain: Accounts
  service: Retail Media
  level: Manage
  description: Create and modify accounts, add/remove brands, create child brand accounts under a Private Market parent.
  note: Manage on this domain requires prior activation by a Criteo contact.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Campaign_Read
  domain: Campaign
  service: Retail Media
  level: Read
  description: Read campaigns, line items, keywords, promoted products and targeting.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Campaign_Manage
  domain: Campaign
  service: Retail Media
  level: Manage
  description: Create and modify campaigns, auction and preferred line items, keywords, promoted products and targeting.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Audience_Read
  domain: Audiences
  service: Retail Media
  level: Read
  description: Read audiences and audience segments available to campaigns.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Audience_Manage
  domain: Audiences
  service: Retail Media
  level: Manage
  description: Create and modify audiences, audience segments and contact lists.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Balance_Read
  domain: Balances
  service: Retail Media
  level: Read
  description: Read balance entities and the spending limits they define.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Balance_Manage
  domain: Balances
  service: Retail Media
  level: Manage
  description: Create balances, add funds, change balance dates and attach campaigns to a balance.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Analytics_Read
  domain: Analytics
  service: Retail Media
  level: Read
  description: Request and retrieve campaign, line-item, revenue, fill-rate, attributed-transaction and real-time performance reports.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Billing_Read
  domain: Billing
  service: Retail Media
  level: Read
  description: Request and retrieve partner billing reports.
  sources: [openapi/criteo-retail-media-api-openapi.yml]
- scope: RetailMedia_Catalog_Manage
  domain: Catalog
  service: Retail Media
  level: Manage
  description: Request a retailer catalog build and retrieve its status and streamed output.
  note: >-
    Catalog exposes only a Manage scope in the spec — there is no RetailMedia_Catalog_Read.
    Reading a catalog requires the same grant as requesting one, because retrieval is the
    second half of an asynchronous request the caller initiated.
  sources: [openapi/criteo-retail-media-api-openapi.yml]

# ---- Marketing Solutions (9) ----
- scope: MarketingSolutions_Campaign_Read
  domain: Campaign
  service: Marketing Solutions
  level: Read
  description: Read campaigns, ad sets, budgets and Marketplace Performance Outcomes entities.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Campaign_Manage
  domain: Campaign
  service: Marketing Solutions
  level: Manage
  description: Create and modify campaigns, ad sets, budgets, bids and MPO seller activation.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Audience_Read
  domain: Audiences
  service: Marketing Solutions
  level: Read
  description: Read audiences and audience segments and compute or estimate their sizes.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Audience_Manage
  domain: Audiences
  service: Marketing Solutions
  level: Manage
  description: Create and modify audiences and segments, and add/remove contact-list members.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Creative_Read
  domain: Creative
  service: Marketing Solutions
  level: Read
  description: Read creatives, ads, assets and coupons.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Creative_Manage
  domain: Creative
  service: Marketing Solutions
  level: Manage
  description: Create and modify creatives, ads, assets and coupons.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Analytics_Read
  domain: Analytics
  service: Marketing Solutions
  level: Read
  description: Request and retrieve advertiser and campaign performance reports.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Reco_Read
  domain: Reco
  service: Marketing Solutions
  level: Read
  description: Read product recommendation configuration and product sets.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]
- scope: MarketingSolutions_Reco_Manage
  domain: Reco
  service: Marketing Solutions
  level: Manage
  description: Create and modify product recommendation configuration and product sets.
  sources: [openapi/criteo-marketing-solutions-api-openapi.yml]

# ---- Commerce Grid (2) ----
- scope: CommerceGrid_Segment_Read
  domain: Segment
  service: Commerce Grid
  level: Read
  description: Read Commerce Grid audience segments.
  sources: [openapi/criteo-commerce-grid-api-openapi.yml]
- scope: CommerceGrid_Segment_Manage
  domain: Segment
  service: Commerce Grid
  level: Manage
  description: Create and modify Commerce Grid audience segments.
  sources: [openapi/criteo-commerce-grid-api-openapi.yml]

summary:
  scope_count: 22
  naming_convention: <Service>_<Domain>_<Level>
  services: [RetailMedia, MarketingSolutions, CommerceGrid]
  levels: [Read, Manage]
  read_scopes: 11
  manage_scopes: 11
  requested_at_token_time: false
  bound_to_application: true

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/criteo-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.