Authorize Requests

When your app requests private data, the request must be authorized by an authenticated user who has access to that data.

Note: If your app accesses the Bid Manager API, it must pass the OAuth verification review. If you see unverified app on the screen when testing your app, you must submit a verification request to remove it. Learn more about unverified apps or get answers to frequently asked questions about app verification.

Every request your app sends to the Bid Manager API must include an authorization token. The token also identifies your app to Google.

About authorization protocols

Your app must use OAuth 2.0 to authorize requests. No other authorization protocols are supported. If your app uses Google Sign-In, some aspects of authorization are handled for you.

Authorizing requests with OAuth 2.0

All requests to the Bid Manager API must be authorized by an authenticated user.

The details of the authorization process, or "flow," for OAuth 2.0 vary somewhat depending on what kind of app you're writing. The following general process applies to all app types:

1. When you create your app, you register it using the Google API Console. Google then provides information you'll need later, such as a client ID and a client secret.
2. Submit an OAuth verification review request for your app in order to access the Bid Manager API scope.
3. Activate the Bid Manager API in the Google API Console. (If the API isn't listed in the API Console, then skip this step.)
4. When your app needs access to user data, it asks Google for a particular scope of access.
5. Google displays a consent screen to the user, asking them to authorize your app for access to some of their data.
6. If the user approves, then Google gives your app a short-lived access token.
7. Your app requests user data, attaching the access token to the request.
8. If Google determines that your request and the token are valid, it returns the requested data.

Some flows include additional steps, such as using refresh tokens to acquire new access tokens. For detailed information about flows for various types of apps, see Google's OAuth 2.0 documentation.

OAuth scope

Here's the OAuth 2.0 scope information for the Bid Manager API:

Scope	Meaning
https://www.googleapis.com/auth/doubleclickbidmanager	Read/write access.

To request access using OAuth 2.0, your app needs the scope information, as well as information that Google supplies when you register your app (such as the client ID and the client secret).