Applications

An application is a set of credentials that represents a system or service making API calls. Each application has a client ID and a client secret. Your integration uses these credentials to obtain access tokens for API requests.

When you create an application, you subscribe it to one or more APIs and select the scopes (access levels) it is granted for each API. The application is then authorized to request tokens scoped to those APIs and the Tealium accounts you specify. For example, you might create one application for an analytics dashboard and a separate one for a third-party integration.

For more information, see Scopes.

Create an application

When you create an application, you configure its API subscriptions as part of the same workflow.

1. Go to Applications in the sidebar and click Create Application.
2. Enter a name and an optional description, then click Create.
3. Select the APIs you want to subscribe to, then click Next: Configure Scopes.
4. Select scopes. Expand each section to view available scopes and check each resource and action pair your application needs. Tokens include only the scopes you select. Request only what your application requires. For more information, see Scopes.
5. Click Next: Review to proceed to account and profile selection.
6. Select accounts and profiles. Select the Tealium accounts and profiles this subscription covers. To assign accounts and profiles, you must be an account admin or have publish permissions on the root profile across all Tag Management environments in that profile.
7. Click Next: Review.
8. Select engines (if applicable). For APIs that require engine-level access, such as the Moments API, a Select Engines step appears. Choose specific engines per profile, or select All engines (current and future) to include engines added later. You can skip this step and grant engine access later.
9. Click Create Subscription.
10. Click View Application to go to your new application’s detail page.

For information about adding subscriptions to an existing application, editing scopes, or managing engine access, see Subscriptions.

After creation, use the Show secret button on the application detail page to reveal your client secret. Copy it or click Download credentials to save it. Store credentials in a secrets manager or environment variable. Never store a client secret in source control.

View application details

In the Applications screen, click an application to view its details.

• Client ID: Your application’s public identifier, used in OAuth2 flows.
• Client Secret: The secret used with the client ID to authenticate. Click Show secret to reveal it, or Download credentials to save both the client ID and secret as a file.
• External Account Access: The Tealium accounts granted access to the application by external users.
• Engine Access: Moments API engines the application can access.
• Subscriptions: APIs your application is subscribed to, with their status and granted scopes.
• API Version: The version of each API your subscriptions target.

For a cross-application view of all account and profile associations and active scopes, go to Tealium Accounts in the sidebar. This section is available to Tealium users only.

Generate a bearer token

You can generate a bearer token for testing from the application detail page. Click Generate Token, select your application, and copy the returned token. For full details, see Authentication.

Rotate the client secret

Rotate the client secret if it is compromised or lost.

1. Open the application detail page.
2. Click Rotate Secret. When prompted, confirm.
3. Copy the new secret and update all systems that use this application’s credentials.

Rotating the secret immediately invalidates the old one. Existing access tokens issued with the old secret continue to work until they expire, but new token requests require the new secret.

Archive an application

Before archiving, close all active subscriptions on the application.

To archive:

1. Open the application detail page.
2. Click Archive and confirm.

Archived applications cannot make API calls.

Engine access management

For engine-enforced APIs, the application detail page shows an Engine Access section. The section displays which engines are granted per API, grouped by account and profile.

• Engines you granted appear as editable.
• Engines granted by other users appear as read-only, with a tooltip identifying the grantor.
• A wildcard badge indicates an All engines grant for that profile.

You can edit your engine selections at any time. Changes take effect immediately. New tokens reflect the updated engine access.