Tealium Authentication

generated: '2026-08-13'
method: searched
source: openapi/_original/*.yml (securitySchemes) + Tealium's own authentication documentation
docs:
  - https://docs.tealium.com/api/v3/getting-started/authentication/
  - https://docs.tealium.com/api/v2/getting-started/auth/
  - https://docs.tealium.com/administration/security-access/api-keys/
  - https://docs.tealium.com/api/v3/scim-api/about/
  - https://docs.tealium.com/server-side/moments-api/managed-mcp-server/
description: >-
  Tealium runs four different authentication models across one platform, and which one applies
  depends on the product rather than the version. The V3 platform APIs use a short-lived JWT
  exchanged from an API key; SCIM uses a 90-day long-lived token from a different host; the Moments
  API uses no credential at all and is governed by a domain allowlist; the managed MCP server uses
  a dedicated static API-key header. There is no OAuth 2.0 and no OpenID Connect anywhere.

summary:
  types:
    - http
    - apiKey
    - none
  oauth2: false
  oidc: false
  mtls: false
  scopes: false
  scopes_note: >-
    No OAuth scope surface exists. Authorization is by Tealium permission groups and admin roles
    attached to the user who generated the key, not by token scope. The long-lived SCIM token
    returns a scope string of "profile email" but no scope is ever requested or enforced.

schemes:
  - name: BearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to:
      - Tealium Collect HTTP API
      - Tealium Visitor Profile API
      - Tealium Visitor Privacy API
      - Tealium iQ Profiles API
    description: >-
      JWT bearer token obtained from the Authentication API
      (POST /v3/auth/accounts/{account}/profiles/{profile}). Tokens are valid for 30 minutes. Do
      not generate a new token for every call — reuse until expiration or Tealium will throttle the
      authentication endpoint at its discretion.
    ttl_seconds: 1800
    obtained_by:
      endpoint: POST https://platform.tealiumapis.com/v3/auth/accounts/{account}/profiles/{profile}
      content_type: application/x-www-form-urlencoded
      parameters:
        - name: username
          description: The Tealium user's email address, URL-encoded.
        - name: key
          description: An API key generated in Tealium iQ, URL-encoded, used in place of a password.
      response_fields:
        - name: token
          description: The JWT bearer token.
        - name: host
          description: >-
            The region-specific host that all subsequent region-specific calls must use, e.g.
            us-east-1-platform.tealiumapis.com. Ignoring this field is the most common integration
            error on the platform.
    sources:
      - openapi/_original/tealium-collect-http-openapi.yml
      - openapi/_original/tealium-visitor-privacy-openapi.yml
      - openapi/_original/tealium-visitor-profile-openapi.yml

  - name: LongLivedBearer
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to:
      - Tealium SCIM API
    description: >-
      A 90-day bearer token for identity-provider integrations, minted from the same username + API
      key pair but on a different host. Tealium describes it as "the OAuth bearer token" for
      provisioning applications, though no OAuth grant is involved.
    ttl_seconds: 7776000
    scope_string: 'profile email'
    obtained_by:
      endpoint: POST https://developer.tealiumapis.com/v2/auth-long-lived/token
      content_type: application/x-www-form-urlencoded
      parameters: [account, profile, username, key]
      rate_limit: 10 requests per minute per IP address
    revocation:
      endpoint: POST https://developer.tealiumapis.com/v2/auth-long-lived/revoke
      parameters: [token, account, profile, username, key, token_type_hint]
      rate_limit: 20 requests per minute per IP address
      semantics: >-
        Immediate and permanent, effective within seconds and not undoable. Returns 200 whether or
        not the token was already expired or revoked; 401 means the supplied credentials do not
        match the credentials used to mint the token.
    guidance: >-
      Tealium recommends minting this from a dedicated service user (for example scim@example.com)
      rather than a person's account, so the integration survives that person's departure.

  - name: MomentsDomainAllowlist
    type: none
    applies_to:
      - Tealium Moments API
    description: >-
      No credential. Access is governed by an allowlist of domains configured on the Moments API
      engine, plus mandatory Origin and Referer headers on every request. This is what makes the
      Moments API callable from a browser without exposing a secret — and what makes the engine
      configuration, not a token, the access-control boundary.
    required_headers: [Origin, Referer]
    boundary: >-
      Each engine defines exactly which audiences, badges and attributes are returned, capped at
      1 kB per visitor per engine, maximum 10 engines per profile.

  - name: TealiumMcpApiKey
    type: apiKey
    in: header
    header_name: X-Tealium-Api-Key
    applies_to:
      - Moments API managed MCP server
    description: >-
      A dedicated static API key issued by Tealium Support specifically for managed MCP server
      access. It is not the standard Tealium iQ API key and not a V3 JWT. Origin and Referer
      headers are also required.
    endpoint: https://us-west-2.prod.developer.tealiumapis.com/v1/personalization/mcp
    provisioning: request from Tealium Support
    probed:
      method: 'POST tools/list without the header'
      http_status: 401
      body: '{"message":"Unauthorized","http_status_code":401}'
      date: '2026-08-13'
    oauth_metadata: >-
      No /.well-known/oauth-protected-resource (RFC 9728) and no
      /.well-known/oauth-authorization-server (RFC 8414) on the MCP host — both 404. This server
      does not implement the MCP OAuth authorization flow.

api_keys:
  management: https://docs.tealium.com/administration/security-access/api-keys/
  scoping: 'Per user, per account/profile, governed by Tealium permission groups and admin roles.'
  test_keys: false
  test_keys_note: There is no test-vs-live key distinction. See sandbox/tealium-sandbox.yml.
  rotation: >-
    No documented automatic rotation or expiry for the underlying API key. Only the derived tokens
    expire (30 minutes for V3, 90 days for long-lived).

account_security:
  sso:
    protocol: SAML 2.0
    idps: [ADFS (Active Directory), Azure, Okta]
    certificate_status_monitoring: true
    docs: https://docs.tealium.com/administration/security-access/single-sign-on/sso/
  mfa:
    supported: true
    docs: https://docs.tealium.com/administration/security-access/multi-factor-authentication-mfa/
  password_policy: https://docs.tealium.com/administration/security-access/password-policy/
  session_timeout: https://docs.tealium.com/administration/security-access/session-timeout/
  ip_allowlist: https://docs.tealium.com/administration/security-access/ip-allow-list/
  scim_provisioning: https://docs.tealium.com/api/v3/scim-api/about/

gaps:
  - No OAuth 2.0 authorization flow and no OpenID Connect discovery.
  - No token scopes — a V3 JWT carries the full permissions of the user who minted it.
  - No documented API-key rotation policy or key expiry.
  - No test-mode credentials.
  - The MCP server's static header key cannot be scoped, rotated per client, or short-lived.