API Authentication

The Allegro REST API authenticates requests using Bearer tokens. You generate these tokens in the Allegro admin UI. Each token is tied to your user account and can never do more than your own role permits — but you can narrow it further by choosing which scopes it carries.

Creating a token

1. Sign in to your Allegro instance.
2. Open the user menu in the top-right corner and choose Settings.
3. Select API Tokens from the left sidebar.
4. Click Create Token and give it a descriptive name (e.g. data-pipeline).
5. Choose the scopes the token should carry, then confirm.
6. Copy the token value that appears — it is only shown once.

Store your token securely

The token value is displayed only at creation time. If you lose it, delete the token and create a new one.

Token scopes

A scope controls what a token is allowed to do. Scopes follow a resource:action shape — for example audience-members:read lets a token read audience members, and products:write lets it create and update products.

When you create a token, the form groups the available scopes by resource. For each resource you can select individual actions, use Select all to grant the whole resource (a resource:* bucket that also covers any actions added to that resource later), or toggle Full access (*) to grant everything. The scopes a token carries are shown as badges next to it in the token list.

The resources you can scope to are:

Resource	Read scope	Write scope
Audience Members	audience-members:read	audience-members:write
Products	products:read	products:write
Entitlements	entitlements:read	entitlements:write
External Profiles	external-profiles:read	external-profiles:write
Foreign Keys	foreign-keys:read	foreign-keys:write
Templates	templates:read	—
Sessions	sessions:read	—
Health	health:read	—

The token-creation form always lists the scopes currently available, so treat that form as the source of truth if this table drifts.

Scopes are a second gate, not a replacement

A token's scopes narrow what it can reach; they never widen it. A request succeeds only when both your account's role allows the action and the token includes a matching scope. A token minted with Full access behaves exactly like your own account.

If a request uses a token that lacks the scope for the endpoint it calls, Allegro rejects it with a 403 Forbidden response even though the token is otherwise valid.

Using the token

Include the token as a Bearer value in the Authorization header of every request:

Authorization: Bearer <your-token>

Example with curl:

curl https://your-instance.allegrocdp.com/api/v1/audience-members \
  -H "Authorization: Bearer <your-token>" \
  -H "Accept: application/json"

Revoking a token

To revoke a token, return to Settings → API Tokens, find the token in the list, and click Delete. The token stops working immediately.