API Authentication
The Allegro REST API authenticates requests using Bearer tokens. You generate these API keys in the Allegro admin UI.
API keys belong to the organization, not to an individual user. Everyone with the Admin role manages the same shared list of keys, and a key keeps working as team members come and go. A key is scoped to its own organization: it is rejected if used against another organization's domain. You narrow what a key can do by choosing which scopes it carries.
Creating a key
- Sign in to your Allegro instance as an organization Admin.
- Open Organization Settings → API Keys.
- Click Create Key and give it a descriptive name (e.g.
data-pipeline). - Choose when the key should expire — 30 days (the default), 90 days, 1 year, a custom date, or never.
- Choose the scopes the key should carry, then confirm.
- Copy the key value that appears — it is only shown once.
A key set to expire stops authenticating at the end of its expiry day and cannot be extended. Give keys the shortest lifetime your integration can tolerate, and rotate them before they lapse rather than choosing Never.
The token value is displayed only at creation time. If you lose it, delete the token and create a new one.
Token scopes
A scope controls what a token is allowed to do. Scopes follow a
resource:action shape — for example audience-members:read lets a token read
audience members, and products:write lets it create and update products.
When you create a key, the form groups the available scopes by resource. For
each resource you can select individual actions, use Select all to grant the
whole resource (a resource:* bucket that also covers any actions added to that
resource later), or toggle Full access (*) to grant everything. The scopes
a key carries are shown as badges next to it in the key list, and you can edit a
key later to change its name, expiration, or scopes. Once a key has expired it
becomes read-only — replace it with a new key rather than editing it.
The resources you can scope to are:
| Resource | Read scope | Write scope |
|---|---|---|
| Audience Members | audience-members:read | audience-members:write |
| Events | events:read | — |
| Products | products:read | products:write |
| Entitlements | entitlements:read | entitlements:write |
| External Profiles | external-profiles:read | external-profiles:write |
| Foreign Keys | foreign-keys:read | foreign-keys:write |
| Templates | templates:read | — |
| Sessions | sessions:read | — |
| Health | health:read | — |
The key-creation form always lists the scopes currently available, so treat that form as the source of truth if this table drifts.
A key's scopes limit what it can do within its organization. A key minted with Full access can reach every endpoint the organization exposes; a narrower key is limited to the resources and actions you granted it.
If a request uses a key that lacks the scope for the endpoint it calls, Allegro
rejects it with a 403 Forbidden response even though the key is otherwise
valid.
Using the key
Include the key as a Bearer value in the Authorization header of every
request:
Authorization: Bearer <your-key>
Example with curl:
curl https://your-instance.allegrocdp.com/api/v1/audience-members \
-H "Authorization: Bearer <your-key>" \
-H "Accept: application/json"
Revoking a key
To revoke a key, return to Organization Settings → API Keys, find the key in the list, and click Revoke. The key stops working immediately, and the revocation is recorded in the page's activity log.
A key can also lapse on its own: when it reaches the expiration you set, it stops authenticating automatically and cannot be extended. Rotate keys before they expire to avoid an interruption.