Third-party app access

Third-party app access lets you grant external applications access to your Tealium accounts and profiles. You control which accounts and profiles each application can access, and you can modify or revoke that access at any time. If you are building an application that needs access to Tealium accounts other than your own, see For application developers.

About delegated authorization

Third-party access uses a delegated authorization model:

1. A developer creates an application in the Developer Portal and subscribes it to Tealium APIs with specific scopes.
2. The developer shares their client ID with you.
3. You look up the application, review its requested scopes, and grant access to specific accounts and profiles.
4. For APIs that require engine access, such as the Moments API, you also select which engines the application can access.
5. The application obtains tokens scoped to the accounts and profiles you approved.

Permission requirements

What you can grant depends on your Tealium role:

• Account admins can grant an application access to all profiles in an account at once.
• Non-admins can grant access to individual profiles. You can only grant a profile if you have publish permissions for both the server-side and tag management profiles. If a profile does not appear in the grant dialog, you do not have the required permissions for it.

The portal only shows accounts and profiles you have permission to grant.

Grant access to an application

1. Go to Third-Party Apps from the sidebar.
2. Enter the client ID provided by the third-party developer and click Look Up.
3. Click Review Access to examine the application’s name, subscriptions, and requested scopes.
4. Check the confirmation box to acknowledge the access level being requested, then click Continue.
5. Select which Tealium accounts to grant access to.
6. Select which profiles within those accounts the application can access.
7. Select engines (if applicable). For APIs with engine enforcement, such as the Moments API, a Select Engines step appears. Choose specific engines per profile, or select All engines (current and future). Engine access is tracked per user. You can modify your engine grants independently of other users who have granted access to the same application. This step is optional. You can add engine access later.
8. Click Grant Access.

The application can only perform actions within the scopes it subscribed to, limited to the accounts and profiles you selected.

Manage granted access

The Third-Party Apps page lists all applications that have access to your resources. For each application, you can:

• View granted scopes: Expand the application card to see which scopes, accounts, and profiles you granted.
• View engine access: Expand the Engine Access card for each engine-enforced API to see which engines are granted, grouped by account and profile. Engines you granted appear as editable. Engines granted by other users appear as read-only, with a tooltip identifying the grantor. A wildcard badge indicates an All engines grant for that profile.
• Edit access: Modify which accounts and profiles the application can access.
• Edit engines: Modify your engine selections for engine-enforced APIs independently of account/profile access.
• Revoke access: Remove all access immediately. The portal invalidates existing tokens.

Respond to scope drift

Scope drift occurs when an application developer changes their API subscriptions after you granted access. When the portal detects a change, a warning badge appears on the affected application card.

To respond to scope drift:

1. Click Review Drift on the application card.
2. Review the changes. The dialog shows added scopes (new capabilities the app is requesting) and removed scopes.
3. Choose an action:
   • Accept: Re-sync the scopes to match the application’s current subscriptions.
   • Revoke: Remove all access immediately.

Until you accept the changes, the application continues operating with the original scopes you approved. The portal does not grant new scopes automatically.

Revoke access

To revoke all access from an application:

1. Go to Third-Party Apps.
2. Click Revoke on the application card.
3. Confirm the revocation.

Revocation is immediate:

• The portal removes all access grants for your accounts and profiles from the application.
• Engine access associated with the revoked accounts and profiles is automatically removed.
• The portal invalidates existing tokens issued with those scopes.
• The application can no longer access your resources.

Revoking access is irreversible. The application owner will need to request a new grant if access is required again.

Partial revocation

You can revoke access to specific accounts or profiles without revoking everything. Only the selected account and profile entries are removed from your grant. Engine access for those accounts and profiles is also removed. Remaining grants continue to work normally.

For application developers

If you are building an application that needs access to other users’ Tealium resources:

1. Create your application in the Developer Portal and subscribe to the required APIs with appropriate scopes.
2. Share your client ID with the resource owners who need to grant you access.
3. Once they grant access, your application’s tokens include scopes for their accounts and profiles. For engine-enforced APIs, such as the Moments API, resource owners must also grant engine-level access before your application can access specific engines.

Request only the scopes your application needs. Resource owners can see exactly what your application is requesting before they grant access.