Impact Radius Authentication

generated: '2026-08-13'
method: searched
source: https://integrations.impact.com/brand-api-reference/brand-api-reference-v13/readme/authentication.md
docs:
- https://integrations.impact.com/brand-api-reference/brand-api-reference-v13/readme/authentication.md
- https://integrations.impact.com/rest-apis/api-quick-start/create-an-api-key.md
- https://integrations.impact.com/ai-solutions/building-with-llms.md
derived_from: openapi/ (securitySchemes across 67 documents)
summary:
  types: [http, apiKey]
  http_scheme: basic
  api_key_in: [header]
  oauth2_flows: [authorization_code_pkce]
  transport: HTTPS only, port 443; plain HTTP fails.
  failure_status: 401
  notes: >-
    The published REST contracts authenticate with HTTP Basic: Account SID is the username (a
    public identifier, similar to a public API key) and Auth Token is the password (the secret),
    base64-encoded into `Authorization: Basic base64(AccountSID:AuthToken)`. Scoped Tokens add
    per-API-category read/write least privilege; tokens minted before April 2025 are "legacy" and
    support only read/write or read-only. Advocate additionally accepts a per-participant JWT for
    client-side calls. OAuth is used off the REST contract: OAuth 2.1 for the hosted MCP server,
    and — per impact.com's own LLM-integration guidance — OAuth 2.0 Authorization Code + PKCE for
    multi-customer applications.
schemes:
- name: basicAuth
  type: http
  scheme: basic
  applies_to: [Brand v11-v14, Partner v14-v15, Agency v2-v3, Advocate v1]
  declared_in_spec: true
  spec_count: 27
  description: >-
    Account SID as username, Auth Token as password, base64-encoded in the Authorization header.
    The dominant scheme — declared in 27 of the harvested OpenAPI documents and applied globally
    in the rest.
  sources: [docs, openapi]
- name: APIKey
  type: http
  scheme: basic
  applies_to: [Advocate v1]
  declared_in_spec: true
  spec_count: 9
  description: >-
    The Advocate specs name the same Basic mechanism `APIKey`. Test-mode and live-mode keys are
    issued per tenant; the key must match the tenant_alias in the path or the API returns RS003,
    RS006 or RS032.
  sources: [openapi, docs]
- name: UserJWT
  type: apiKey
  in: header
  header_name: X-SaaSquatch-User-Token
  applies_to: [Advocate v1 open/client-facing endpoints]
  declared_in_spec: true
  spec_count: 6
  description: >-
    Signed per-user JWT for client-side calls made from a browser or mobile app, so a participant
    can read their own data without the tenant secret being shipped to the client. The Account SID
    must be carried as a child in the JWT header. Required when Secure Mode is enabled; failures
    surface as RS005 (checksum required), RS006/RS032 (bad checksum or JWT) and RS045 (missing
    credentials).
  sources: [openapi, docs]
- name: scopedTokens
  type: apiKey
  in: header
  applies_to: [Brand, Partner, Agency]
  declared_in_spec: false
  description: >-
    Fine-grained access tokens created in the account UI (Settings -> Technical -> API -> Create
    Access Token). Each token pins an API version and toggles API categories with per-category
    read/write scopes. Presented over the same HTTP Basic Account SID + Auth Token pair, so the
    wire format is unchanged — the difference is authorization, not authentication. A disabled
    scoped token, or a call to an endpoint the token does not enable, returns 403 rather than 401.
  sources: [docs]
- name: oauth2.1
  type: oauth2
  applies_to: [mcp.impact.com]
  declared_in_spec: false
  description: >-
    OAuth 2.1 for the hosted MCP server. Per-client MCP usage tokens with refresh tokens; the
    end user's platform credentials are never shared with the AI assistant, only a revocable
    token. An administrator can disable MCP account-wide, which deletes existing tokens.
  discovery:
    oauth_authorization_server: 404
    oauth_protected_resource: 404
    openid_configuration: 404
    checked: '2026-08-13'
    note: No RFC 8414 / RFC 9728 / OIDC discovery document is served on any impact.com host.
  sources: [docs, probe]
- name: oauth2-authorization-code-pkce
  type: oauth2
  applies_to: [multi-customer applications]
  declared_in_spec: false
  description: >-
    impact.com's "Building with LLMs" guide states that multi-customer apps follow OAuth 2.0
    Authorization Code + PKCE with documented token rotation. No OAuth endpoints, scopes or
    registration flow were located on the public developer portal in this pass, and no oauth2
    securityScheme appears in any of the 67 published specs — so this is recorded as documented
    but not machine-readable.
  sources: [docs]
base_urls:
  brand: https://api.impact.com/Advertisers/{AccountSID}/
  partner: https://api.impact.com/MediaPartners/{AccountSID}/
  agency: https://api.impact.com/Agencies/{AccountSID}/
  advocate: https://app.referralsaasquatch.com/api/v1/{tenant_alias}/
  mcp: https://mcp.impact.com/mcp
credential_handling:
  guidance_published: true
  detail: >-
    The docs tell integrators never to hardcode secrets, to store them in a vault or encrypted
    environment variables, to start with read-only scopes, and to promote separate tokens per
    environment (development / staging / production). They also tell users to redact Account SID,
    Auth Token, OAuth tokens, bearer tokens and customer identifiers before pasting doc examples
    into third-party assistants.
  rotation: Tokens can be rotated, duplicated, disabled and deleted from the token detail page.
notes: >-
  Upgraded from the 2026-07-19 pass. Scheme names, counts and header names are now cross-checked
  against the 67 harvested OpenAPI documents rather than the docs alone, which surfaced the
  Advocate UserJWT header that the prose pages describe but do not name.