Skip to main content
Deutsch Français Nederlands

API Authentication with OAuth

  • Updated

In order to use the Daisycon API you will need to have an active advertiser account. Authentication with the Daisycon API is only possible with OAuth 2.1. 

Daisycon API Authentication Guide (OAuth 2.1 with PKCE)

Authentication Overview

The Daisycon API only supports OAuth 2.1 with PKCE. Follow these steps:

  1. Set up a Developer Account
  2. Create an App & Retrieve Client Credentials
  3. Perform an Authorization Call & Token Exchange
  4. Start Using the API with Access Tokens
  5. Perform a Refresh Call

Step 1: Set Up a Developer Account

Before beginning, set up a developer account on the Daisycon platform. Note that you need an existing publisher or advertiser account to do so. For more details, see our Developer Account Setup guide.

Step 2: Create an App & Retrieve Client Credentials

After setting up a developer account, register your app in the Daisycon system to obtain a client ID and client secret. Be mindful of permissions, as your app should only have what it truly needs. For more details about how to create an app, see our Creating an App guide.

Step 3: Authorization Call & Token Exchange

1. Generate a Code Verifier

Use a random string of 43–128 characters (allowed characters: [A-Z, a-z, 0-9, "-", ".", "_", "~"]).

PHP Example:

function randomString($length) {
    if ($length < 1) {
        throw new InvalidArgumentException('Length must be a positive integer');
    }
    $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-._~';
    $out = '';
    for ($i = 0; $i < $length; ++$i) {
        $out .= $chars[random_int(0, strlen($chars) - 1)];
    }
    return $out;
}

$codeVerifier = randomString(43);

JavaScript Example:

function generateRandomString(length) {
    const allowedChars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
    let randomString = '';
    for (let i = 0; i < length; i++) {
        randomString += allowedChars.charAt(Math.floor(Math.random() * allowedChars.length));
    }
    return randomString;
}
const codeVerifier = generateRandomString(43);

2. Create a Code Challenge

Hash the code verifier with SHA-256, then Base64 URL-encode it.

PHP Example:

private function hash($code): string {
    return str_replace(
        '=',
        '',
        strtr(base64_encode(hash('sha256', $code, true)), '+/', '-_')
    );
}
$codeChallenge = hash($codeVerifier);

JavaScript Example:

async function generateCodeChallenge(codeVerifier) {
    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
    return btoa(String.fromCharCode(...new Uint8Array(digest)))
        .replace(/=/g, '')
        .replace(/\+/g, '-')
        .replace(/\//g, '_');
}
const codeChallenge = await generateCodeChallenge(codeVerifier);

3. Redirect User to OAuth URL

Use the URL below, replacing placeholders with your app details. Be sure to URL encode all query parameter values, and ensure your redirect URI is registered to the app.

https://login.daisycon.com/oauth/authorize?response_type=code&client_id=APP_CLIENT_ID&redirect_uri=APP_REDIRECT_URI&code_challenge=GENERATED_CODE_CHALLENGE

Optionally, you can add the state parameter with your own data, which will be returned to the callback redirect URL.

4. After a Successful Login

Upon successful login, the OAuth will redirect to your redirect URI with a code (and optionally, your state).

https://your-redirect.uri/and/path?code=OAUTH_CODE[&state=YOUR_STATE]

5. Token Exchange via Server-Side POST

Use the received authorization code for token exchange. If your app is a client-side app, do not include your client secret!

PHP Example (with client secret).
For Sandbox use “https://login.daisycon.com/oauth-sandbox/access-token” 

function httpPost($url, $data) {
    $curl = curl_init($url);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($data));
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($curl);
    curl_close($curl);
    return $response;
}

$response = httpPost('https://login.daisycon.com/oauth/access-token', [
    'grant_type'    = 'authorization_code',
    'redirect_uri'  = 'APP_REDIRECT_URI',
    'client_id'     = 'APP_CLIENT_ID',
    'client_secret' = 'APP_CLIENT_SECRET',
    'code'          = 'RECEIVED_AUTH_CODE',
    'code_verifier' = 'GENERATED_CODE_VERIFIER',
]);

JavaScript Example (without client secret):
For Sandbox use “https://login.daisycon.com/oauth-sandbox/access-token” 

const data = {
    grant_type: 'authorization_code',
    code: 'RECEIVED_AUTH_CODE',
    client_id: 'APP_CLIENT_ID',
    redirect_uri: 'APP_REDIRECT_URI',
    code_verifier: 'GENERATED_CODE_VERIFIER'
};

fetch('https://login.daisycon.com/oauth/access-token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(data)
}).then(response = response.json())
  .then(data = console.log(data))
  .catch(error = console.error(error));

Sample Response

{
   "access_token": "string",
   "refresh_token": "string"
}

Step 4: Start Using the API

Now that you have an access token and a refresh token, you can start using the API by supplying the access token in the Authorization header.

Step 5: Refreshing the Token

After 30 minutes, your authentication token will expire. Use the refresh token to obtain a new access token and refresh token. A refresh token can only be used once, so be sure to store the new one!

PHP Example (with client secret):
For Sandbox use “https://login.daisycon.com/oauth-sandbox/access-token” 

function httpPost($url, $data) { ... }
$response = httpPost('https://login.daisycon.com/oauth/access-token', [
    'grant_type'    = 'refresh_token',
    'redirect_uri'  = 'APP_REDIRECT_URI',
    'client_id'     = 'APP_CLIENT_ID',
    'client_secret' = 'APP_CLIENT_SECRET',
    'refresh_token' = 'RECEIVED_REFRESH_TOKEN',
]);

Common Issues & Troubleshooting

  1. Token Permissions Error: Ensure app permissions align with user permissions. This issue typically occurs if the app requests permissions that the authenticating user does not have. To resolve this, check and adjust the app’s permissions to match those of the user.
  2. Client Authentication Failed: This error could be due to various reasons, such as an incorrect client ID, redirect URI, or code verifier. Verify that all values are correct and match exactly with what was registered, including any trailing slashes in the redirect URI.
  3. Server to Server Setup: If your app does not support user interaction, consider using our OAuth over CLI guide for a command-line-based authentication setup.
  4. TLS 1.3 Requirement: As of April 3rd, 2023, Daisycon API only supports TLS 1.3 for improved security. Ensure your environment is configured to use TLS 1.3.

Authentication in the Swagger Daisycon API documentation

In the Swagger Daisycon API documentation, you can interact with most of the available API resources. Authentication is also required here. To get started, follow these steps:

  1. Go to the Daisycon Common Data API documentation and locate the /authenticate call.
  2. Click on Try it out to enable the fields for input.
  3. In the body section, replace the "string" placeholders with your Daisycon username and password. Put them between the quotation marks.
  4. Click on Execute.

If successful, you will receive the required authentication token in the response body. Copy this token (a long string), but do not include the double quotes.

  1. Next, go to the Swagger Daisycon API documentation for advertisers, publishers, or common data.
  2. Click on Authorize (usually found at the top of the page).
  3. In the Value field, paste the token you copied, preceded by Bearer (note the space after "Bearer").
  4. Click on Authorize again.

If successful, the status will show as Authorized, and you can now make API calls using the authenticated session.

Additional Resources

We offer documentation and code examples. Feel free to contribute by sending pull requests.

Related articles