Campaignmonitor Authentication

generated: '2026-08-13'
method: searched
source: https://www.campaignmonitor.com/api/v3-3/getting-started/
docs: https://www.campaignmonitor.com/api/v3-3/getting-started/
description: >-
  Campaign Monitor publishes no OpenAPI, so this profile was read from the
  provider's own Getting Started page rather than derived from securitySchemes.
  The API supports exactly two authentication models: OAuth 2.0 (preferred for
  third-party integrations) and an API key over HTTP Basic (username = API key,
  password ignored).
base_url: https://api.createsend.com/api/v3.3
summary:
  types: [oauth2, http]
  preferred: oauth2
  mfa_on_api: false
  mtls: false
  openid_connect: false
schemes:
  - name: oauth2
    type: oauth2
    description: >-
      OAuth 2.0. Applications are registered inside the Campaign Monitor account
      (Integrations -> OAuth Registration) and issued a Client ID and Client
      Secret. Access tokens are passed as bearer tokens.
    flows:
      - name: authorization_code
        label: Web Application Flow
        authorization_url: https://api.createsend.com/oauth
        token_url: https://api.createsend.com/oauth/token
        required_query_params:
          type: web_server
          client_id: The Client ID issued at registration
          redirect_uri: Must begin with the redirect URI registered for the application (scheme, authority and path elements must match)
          scope: Comma-separated list of permissions
          state: Optional passthrough state
        refresh: >-
          Long-lived refresh_token returned with the grant; POST
          grant_type=refresh_token&refresh_token={refresh_token} to
          https://api.createsend.com/oauth/token
      - name: implicit
        label: Non-Web Application Flow (desktop / native)
        authorization_url: https://api.createsend.com/oauth
        token_url: null
        required_query_params:
          type: user_agent
          client_id: The Client ID issued at registration
          redirect_uri: Must begin with the registered redirect URI
          scope: Comma-separated list of permissions
        refresh: >-
          No refresh token is issued in this flow. Clients must use the
          expires_in value returned in the URL fragment to decide when to
          request a new token.
    token:
      transport: Authorization request header
      format: "Authorization: Bearer {access_token}"
      expires_in_seconds: 1209600
      note: expires_in is returned per grant; the documented example value is 1209600 seconds (14 days).
    scopes_artifact: scopes/campaignmonitor-scopes.yml
    scope_delimiter: ","
    pkce: false
    discovery_document: false
    errors:
      - code: invalid_request
        meaning: Required parameters were not supplied.
      - code: unknown_client
        meaning: The client_id did not match a registered integration.
      - code: invalid_redirect_uri
        meaning: The redirect_uri did not begin with the registered redirect URI.
      - code: server_error
        meaning: Something went wrong at the Campaign Monitor end.
      - code: unknown_scope
        meaning: Unrecognised permissions were requested via the scope parameter.
      - code: access_denied
        meaning: The end-user did not grant authorisation.
  - name: apiKeyBasic
    type: http
    scheme: basic
    description: >-
      API key over HTTP Basic authentication. The API key is supplied as the
      Basic username; the password portion is unused and may be blank or a dummy
      value. Keys are retrieved from Account Settings -> API keys in the app.
    key_scope:
      - account-level API key (agency/account wide — client must then be named explicitly on agency endpoints)
      - client-specific API key (implies the client, so clientID parameters can be omitted)
    rotation_policy: null
    key_prefix: null
    note: >-
      Campaign Monitor does not publish a key prefix convention or a documented
      rotation/expiry policy for API keys.
auth_errors:
  - status: 401
    code: 100
    message: Invalid API Key
  - status: 401
    code: 120
    message: Invalid OAuth Token
  - status: 401
    code: 121
    message: Expired OAuth Token
  - status: 401
    code: 122
    message: Revoked OAuth Token
  - status: 401
    code: 102
    message: Invalid ClientID — a resource ID that does not belong to the authenticated account also returns 401, not 403/404
  - status: 403
    code: 403
    message: Not allowed for a Non-agency Customer (agency-only resources)
  - status: 401
    code: 60
    message: You do not have the required permission to access this resource (OAuth token missing the needed permission)
transport_security:
  tls_minimum: TLSv1.2
  note: >-
    Campaign Monitor deprecated legacy TLS 1.0 and 1.1; TLS 1.2 is the stated
    minimum supported protocol (https://www.campaignmonitor.com/api/).
  detail: security/campaignmonitor-domain-security.yml