About the Tealium Developer Portal

The Tealium Developer Portal is a self-service platform for managing programmatic access to Tealium APIs for Tealium account holders, third-party developers, and agencies building integrations for Tealium customers. From the portal you can create OAuth2 applications, subscribe to APIs with fine-grained scope control, manage credentials, and monitor API usage.

How it works

The portal organizes access around four interconnected concepts:

• Applications hold credentials.
• Subscriptions connect applications to APIs.
• Scopes define what an application is authorized to access.
• Authentication describes how tokens are obtained and validated on every request.

Applications

An application is an OAuth2 client, a named credential holder that represents a system or service making API calls. Each application has two pieces of identity:

• Client ID: A public identifier included in every token request.
• Client secret: A private credential used with the client ID to prove the application’s identity.

Create one application per integration. A single integration may require subscriptions to multiple APIs, and one application can hold all of those subscriptions. For example, create one application for an analytics dashboard and a separate one for a data pipeline.

Manage your applications from the Applications tab in the portal. For more information, see Applications.

Subscriptions

A subscription connects an application to a specific API. When you create a subscription, you specify:

• Which API the application can call.
• The access levels (scopes) the application is granted for that API.
• The Tealium accounts and profiles the application can access.

Without a subscription to an API, an application cannot request tokens for that API. An application can subscribe to multiple APIs, each with a separate scope and account configuration.

Manage your subscriptions from the Subscriptions tab in the portal. For more information, see Subscriptions.

Scopes

Scopes define the exact access an application is granted. Tealium uses compound scopes that encode the full access context in a single string:

{account}:{profile}:{resource}:{action}

For example, my-account:main:audiences:read grants read access to audiences in the main profile of my-account. The * wildcard grants access across all profiles in an account: my-account:*:audiences:read.

When you subscribe to an API, you select the maximum set of scopes the application is allowed to request. When requesting a token, you can request any subset of those subscribed scopes. Requesting a subset of scopes generates a token scoped to a specific task, even if the application’s subscription grants broader access.

For full scope reference including engine-level scopes, see Scopes.

Authentication

All Tealium API requests require a bearer token. Tokens are short-lived JWTs obtained using the OAuth2 Client Credentials grant. Your application presents its client ID and secret to the token endpoint, which returns a signed token the API gateway validates on every request.

Application                 Token Endpoint           API Gateway
    |                            |                        |
    |-- POST /oauth/token ------->|                        |
    |   client_id                |                        |
    |   client_secret            |                        |
    |   scope                    |                        |
    |<-- access_token (JWT) -----|                        |
    |                            |                        |
    |-- GET /api/endpoint --------------------------->|
    |   Authorization: Bearer {token}                     |
    |<-- 200 OK ------------------------------------------|

Tokens expire after one hour. There is no refresh token. Your application requests a new token when the current one expires. Cache tokens and reuse them within their lifetime to avoid throttling.

The gateway validates the token’s scope claim on every request. If the token lacks the required account, profile, resource, and action combination, the gateway returns 403 Forbidden.

For full details on token requests, scope enforcement, and security best practices, see Authentication.

Developer portal workflow

A complete integration follows this sequence:

1. Create an application: Establishes the OAuth2 client identity (client ID and secret).
2. Subscribe to an API: Selects which APIs, scopes, and Tealium accounts the application can access.
3. Request a token: The application presents its credentials and receives a JWT scoped to the subscribed access.
4. Call the API: The application includes the token in every request. The gateway validates the scope claim and executes the call.

Third-party access

If you are a third-party developer or agency building an integration for a Tealium customer, the portal supports a delegated authorization model:

1. Create an application and subscribe to the APIs you need.
2. Share your application ID with the resource owner.
3. The resource owner looks up your application in the portal and grants it access to their specific accounts, profiles, and engines.
4. Your tokens then include scopes for those resources.

The resource owner controls exactly which accounts, profiles, and engines they grant and can modify or revoke that access at any time.

For details, see Third-party app access.

Get started

To start making API calls:

1. Read the getting started tutorial for a step-by-step walkthrough.
2. Use Applications to create your first application and subscribe to APIs.
3. Use Authentication and credentials to request tokens and make API calls.