Hooklogic Criteo Authentication

generated: '2026-08-13'
method: searched
docs: https://developers.criteo.com/criteo-apis/docs/authentication
source: >-
  openapi/hooklogic-criteo-*-openapi.yml (all eight refined specs declare the
  same `oauth` scheme), upgraded from
  https://developers.criteo.com/criteo-apis/docs/authentication and the
  provider-published Agent Skill at
  https://developers.criteo.com/.well-known/agent-skills/criteo/skill.md
note: >-
  The Criteo Retail Media API (the HookLogic product line) is OAuth 2.0 only —
  there is no API-key or basic-auth path. Every one of the eight refined
  OpenAPI documents declares the same single `oauth` security scheme, so the
  profile is stated once here rather than repeated per spec. Two grants are
  supported and they differ in more than plumbing: client-credentials is
  application-scoped and single-data-owner, authorization-code is account-scoped
  and requires explicit advertiser consent, which is also what determines the
  rate limit an integration gets.
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  api_key: false
  basic: false
  mtls: false
schemes:
- name: oauth
  type: oauth2
  applies_to: all eight Retail Media specs (Accounts, Analytics, Audience, Balance, Billing, Campaign, Catalog, Gateway)
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.criteo.com/oauth2/token
    scope_level: application
    use_case: server-to-server, single data owner
    rate_limit: 250 calls/min default, 40 calls/min reporting
  - flow: authorizationCode
    authorizationUrl: https://api.criteo.com/oauth2
    tokenUrl: https://api.criteo.com/oauth2/token
    scope_level: account
    pkce: true
    pkce_docs: https://developers.criteo.com/criteo-apis/docs/oauth-app-authorization-code-pkce-setup
    use_case: multi-user, self-service platforms
    rate_limit: 10 calls/min per account per user, scales with consents
    refresh_token: valid 6 months; revoked if the user's role changes
  header: 'Authorization: Bearer <access_token>'
  token_lifetime_seconds: 900
  scopes: scopes/hooklogic-criteo-scopes.yml
onboarding:
  steps:
  - Create a Criteo partner account
  - Create an organization
  - Create an API application and select the permission domains it needs
  - Retrieve client credentials
  - For authorization-code apps, generate a consent URL and have the advertiser approve it
  docs: https://developers.criteo.com/criteo-apis/docs/connect-to-the-api
failure_modes:
- status: 401
  cause: missing or expired access token (tokens live 900 seconds)
- status: 403
  cause: token lacks the permission domain for the endpoint, or an account admin revoked the application's consent
see:
  scopes: scopes/hooklogic-criteo-scopes.yml
  conventions: conventions/hooklogic-criteo-conventions.yml
  errors: errors/hooklogic-criteo-problem-types.yml