Adobe Campaign Authentication

generated: '2026-08-13'
method: searched
source: >-
  https://experienceleague.adobe.com/en/docs/campaign/campaign-v8/developer/apis/setting-up-api-access
  and https://experienceleague.adobe.com/en/docs/campaign/campaign-v8/developer/apis/global-concepts/must-read
  (fetched 2026-08-13); https://ims-na1.adobelogin.com/.well-known/openid-configuration
  (probed 2026-08-13, HTTP 200); openapi/_original/adobe-campaign-classic-openapi-original.yml
  and openapi/_original/adobe-campaign-standard-openapi-original.yml
notes: >-
  Adobe Campaign has TWO distinct authentication models, one per deployment
  surface, and they are not interchangeable. The REST surface on
  https://mc.adobe.io/{ORGANIZATION}/campaign authenticates with an Adobe IMS
  OAuth Server-to-Server access token in Authorization: Bearer PLUS an
  X-Api-Key header carrying the Adobe Developer Console client ID — both are
  required on every call. The Campaign Classic SOAP-over-HTTP surface on
  https://{instance}.campaign.adobe.com authenticates with a session token pair
  obtained from xtk:session#Logon: the __sessiontoken cookie plus the
  X-Security-Token header. Adobe's docs state Campaign APIs are server-to-server
  only.
  This file was regenerated by derive-authentication.py on 2026-08-13 against
  the refined per-tag specs, which only carry the Classic SessionToken scheme;
  the IMS bearer + API key schemes were restored from the _original specs and
  upgraded against the live documentation, so this artifact is not weaker than
  the round it replaced.
summary:
  types:
    - apiKey
    - http
    - oauth2
  api_key_in:
    - header
    - cookie
  server_to_server_only: true
schemes:
  - name: BearerAuth
    surface: Campaign Standard / Campaign v8 REST (https://mc.adobe.io/{ORGANIZATION}/campaign)
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: >-
      Adobe IMS OAuth Server-to-Server access token. Obtained with a
      client_credentials exchange against
      https://ims-na1.adobelogin.com/ims/token/v3 using the Client ID and Client
      Secret issued by an Adobe Developer Console project that has the Adobe
      Campaign service added.
    token_endpoint: https://ims-na1.adobelogin.com/ims/token/v3
    authorization_endpoint: https://ims-na1.adobelogin.com/ims/authorize/v2
    issuer: https://ims-na1.adobelogin.com
    jwks_uri: https://ims-na1.adobelogin.com/ims/keys
    docs: https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/implementation/
    sources:
      - openapi/_original/adobe-campaign-standard-openapi-original.yml
      - well-known/adobe-campaign-openid-configuration.json
  - name: ApiKeyAuth
    surface: Campaign Standard / Campaign v8 REST (https://mc.adobe.io/{ORGANIZATION}/campaign)
    type: apiKey
    in: header
    parameter: X-Api-Key
    required_with: BearerAuth
    description: >-
      The Adobe Developer Console API Key (Client ID) for the integration. Sent
      on every REST call alongside the bearer token; a request with a valid
      bearer token but no X-Api-Key is rejected.
    docs: https://developer.adobe.com/developer-console/docs/guides/authentication/
    sources:
      - openapi/_original/adobe-campaign-standard-openapi-original.yml
      - https://experienceleague.adobe.com/en/docs/campaign/campaign-v8/developer/apis/setting-up-api-access
  - name: SessionToken
    surface: Campaign Classic SOAP-over-HTTP (https://{instance}.campaign.adobe.com)
    type: apiKey
    in: header
    parameter: X-Security-Token
    description: >-
      Security token returned by xtk:session#Logon. Must be sent together with
      the __sessiontoken cookie on every authenticated Classic call. Tokens have
      a 24-hour lifecycle and are terminated with xtk:session#Logout.
    paired_with:
      in: cookie
      parameter: __sessiontoken
    sources:
      - openapi/_original/adobe-campaign-classic-openapi-original.yml
      - openapi/adobe-campaign-session-management-api-openapi.yml
      - https://experienceleague.adobe.com/docs/campaign-classic/using/configuring-campaign-classic/api/web-service-calls.html
tenancy:
  organization_id:
    description: >-
      Every REST path is scoped by an ORGANIZATION ID issued by Adobe per
      instance. The production instance uses <ORGANIZATION>; the staging instance
      uses <ORGANIZATION-mkt-stage>.
    production_pattern: https://mc.adobe.io/<ORGANIZATION>/campaign
    stage_pattern: https://mc.adobe.io/<ORGANIZATION-mkt-stage>/campaign
  authorization_model: >-
    Campaign APIs run in the administrator context by default and are excluded
    from the role context — organizational units and roles do NOT apply to API
    callers unless Adobe explicitly configures it. This is a meaningful blast-radius
    fact for any agent integration.
deprecated:
  - mechanism: Service Account (JWT) credential
    replaced_by: OAuth Server-to-Server credential
    end_of_support: '2025-01-27'
    source: https://experienceleague.adobe.com/en/docs/campaign/campaign-v8/developer/apis/setting-up-api-access
    note: >-
      JWT service-account credentials stopped working 2025-01-27. Campaign v8.5.1
      also made Adobe IMS mandatory for technical operators connecting to
      Campaign.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com