Authentication

The CRM API uses OAuth 2.0 client credentials. Your integration exchanges its credentials for a bearer token on the D-EDGE CRM ID server, then sends that token in the Authorization header of every call.

What D-EDGE delivers

Three values, handed over during the build step of your integration journey, after the partnership agreement. They are not self-served.

Value	Use
Token endpoint	The URL of the D-EDGE CRM ID server your integration calls to obtain a token
Client ID	Identifies your integration
Client secret	Authenticates it

The token grants access to the entities your integration is registered for: calls on guests and segments carry an entity identifier, and the token decides which entities you can read and write.

Get a token

Post your credentials to the token endpoint as form data:

curl --request POST \
  --url https://{tokenUrl} \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=client_credentials \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET

The response carries the token and its lifetime in seconds:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 300,
  "token_type": "Bearer",
  "scope": "email profile"
}

Use the token

curl --request GET \
  --url 'https://{apiBaseUrl}/api/guestprofile/entities/{entityId}/segments' \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Tokens live 300 seconds. Cache the one you hold for slightly less than its expires_in and request a fresh one when it lapses, rather than waiting for a call to fail.

When authentication fails

A missing token, an invalid token, or a token without access to the requested entity all return 401 Unauthorized with the code system.accessDenied. The three cases are indistinguishable from the response, which is deliberate: it prevents probing for entities you do not have access to. See Responses for the error format.

Keep your credentials safe

Call the API from your server, never from a browser or a mobile app: a secret shipped to the client is public.
Store the client secret in your secret manager or environment variables, not in source code.
Keep tokens in memory only: with a 300-second lifetime, there is nothing worth persisting.
If a credential leaks, contact us to rotate it.

Get started

Build

Resources

What D-EDGE delivers

Get a token

Use the token

When authentication fails

Keep your credentials safe

​What D-EDGE delivers

​Get a token

​Use the token

​When authentication fails

​Keep your credentials safe

What D-EDGE delivers

Get a token

Use the token

When authentication fails

Keep your credentials safe