Skip to main content

API Keys

note

These instructions are for client-server or server-side implementations. If your UID2 implementation will be client-side, or visible to the public in any way, you'll need to set up different values. For details, see Client-Side Integration.

In the UID2 Portal, on the API Keys page, you can perform all activities relating to managing the API keys for your UID2 account, including the following:

Overview​

The API key and client secret allow you to connect to the UID2 Operator Service and call API endpoints, directly or via one of the UID2 SDKs. These values identify you to the service.

important

When you add an API key in the UID2 Portal, you must store the key and its corresponding secret securely and do everything necessary to make sure that these values are not compromised. For more information, see API Key and Client Secret.

We recommend rotating each API key on a yearly basis.

When you add an API key, you can assign one or more of the following permissions:

  • Mapper
  • Generator
  • Sharer
  • Bidder

For details, see API Permissions.

Adding an API Key​

To add an API key, complete the following steps:

  1. Log in to your UID2 Portal account.

  2. On the API Keys page, click Add API Key.

  3. In the Add API Key page, provide a name for the new key.

  4. In the API Permissions section, choose one or more permissions for your key.

    Choose only the permissions that you need. For example, if you're a publisher, choose the Generator role. For details, see API Permissions.

    note

    If the permission that you want to add isn't available for selection, ask your UID2 contact.

  5. Click Add API Key.

    In the API Key (Your API Key Name) Credentials page, the API key and secret are displayed.

  6. In each field, click the Copy icon (the Copy icon) to copy the value. Store the Secret and Key values in a secure location, and do not share them.

    When you close the window, these values are not saved and are no longer available to you. If they are lost, you'll need to add a new key.

  7. When done, click Close.

  8. At the reminder prompt, you have a chance to go back if you didn't yet save the values. Click Cancel to go back, or Close to confirm.

    On the API Keys page, the new key is displayed with the name, Key ID, permissions, and the date it was created.

Modifying an API Key​

After you've added an API key, you can edit the following:

  • API key name
  • Permission assignments

To modify an API key, complete the following steps:

  1. In the UID2 Portal, go to the API Keys page.
  2. Find the key on the list.
  3. In the Actions column, click the Edit icon (the Edit icon).
  4. Update the information, and then click Save Key.

Deleting an API Key​

If a key is compromised, you'll need to remove it.

warning

Be sure that your implementation is updated with a new key before deleting an active key. When you delete a key, any subsequent API traffic using that key is rejected.

To delete an API key, follow these steps:

  1. In the UID2 Portal, go to the API Keys page.

  2. Find the key on the list and then, in the Actions column, click the Delete icon (the Delete icon).

  3. At the confirmation message, type the API key to confirm that you want to delete it. You can copy and paste from the display.

  4. Click Delete Key.

    The key is removed from the display and is no longer valid.

Rotating an API Key​

We recommend rotating each API key on a yearly basis. To rotate an API key, follow these steps:

  1. In the UID2 Portal, go to the API Keys page.
  2. Find the key in the list that needs to be rotated.
  3. Add a new key with the same permissions as the key that needs to be rotated. For details, see Adding an API Key.
  4. Update your UID2 implementation to use the new key instead of the key that needs to be rotated.
  5. Ensure the new key is being used without issues. For example, make sure there is no degradation to the service or error logs related to the API key usage.
  6. Delete the old key. For details, see Deleting an API Key.

Security Recommendations for API Keys​

It's a security best practice, though not required, to have separate keys for separate roles.

For additional security recommendations, see Security of API Key and Client Secret.