Intelligence Analytics API Authentication

The Intelligence Analytics API uses OAuth-based authentication. To access the API, you need an API Client ID and Client Secret. You use these credentials to request an access token, and you include that token in every Analytics API request.

Enable API access

The Analytics API is an optional feature. API access must be enabled for your account before you can use it. If API access is not available for your account, contact your Customer Success Manager.

Until access is enabled, the API Client IDs area remains visible, but token use is disabled. If the API is later disabled for an account, authentication with an existing Client ID fails.

As a Mapp Intelligence administrator, you can restrict and manage API access in user management at the account level.

Create API credentials

Create an API Client ID and Client Secret in Settings > Mapp Cloud > API Client IDs.

In the API Client ID overview, you can:

Enter a description to differentiate Client IDs.
Set a token validity time. The default is 60 minutes.
Temporarily deactivate a Client ID.
Revoke or delete a Client ID permanently.

After creation, you can copy the Client ID and Client Secret from the overview. The Client ID is shown in clear text; the Client Secret is hidden. Each Client ID is bound to the user who created it. For automated integrations, use a dedicated technical user so access is not disrupted when an individual user is deactivated.

Warning
Store your Client Secret securely. Do not expose credentials in frontend applications, browser code, public repositories, or logs.

Note
A single Client ID provides access across the Mapp Cloud APIs, including Connect, Mapp Intelligence, Mapp Engage, and Mapp Fashion. You do not need separate credentials for each service. The Analytics API itself must still be enabled for your account.

Request an access token

Request an access token from the token endpoint using the Client Credentials flow. Authenticate with HTTP Basic Auth: set the Authorization header to Basic followed by the Base64 encoding of client-id:client-secret. The request body contains only the grant type.

POST https://auth.mapp.com/oauth2/token
Authorization: Basic <authentication>
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials

Here, <authentication> is the Base64-encoded value of client-id:client-secret.

Do not send a scope parameter. Earlier versions of the Analytics API authentication used a scope; the current token endpoint does not use scopes. If you are updating an existing integration, remove the scope parameter from your token request.

The following example uses curl, which builds the Basic Auth header automatically from the credentials you pass:

curl -X POST "https://auth.mapp.com/oauth2/token" \
  -u "<client-id>:<client-secret>" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials"

The response returns an access token. The token remains valid until it expires or is revoked. Its validity is independent of the Client ID's activation status.

Use the access token

Include the access token in the Authorization header of every Analytics API request:

Authorization: Bearer <access-token>

Example request