Back to overview

Improved API authorization for SSO (Codeflow) integrations

Placed on:8 September 2026

From September 8, we will introduce an improved authorization process for API integrations that use Single Sign-On (SSO).

With this change, partners, advertisers and suppliers will gain more control over the API access they grant to integration partners. Instead of authorizing access to the entire API, users will explicitly select which API components an integration partner may access and which permissions are granted.

What is changing?
Until now, integrations using SSO automatically received access to the full API after authorization.

With the new authorization flow, users will select:

  • Which API components (resources) may be accessed by the integration partner
  • Which permissions are granted (read-only or manage)


During the authorization process, users will only see the API components that are relevant to the integration partner they are connecting to. These components will be pre-selected by default. Users should review the selection and, if needed, deselect specific components.

This approach makes permissions more transparent and ensures API access is aligned with the services provided by the integration partner.

Who is affected?
This change applies to:

  • New API integrations using SSO
  • Existing SSO integrations that are renewed after their current authorization expires

Existing authorizations will continue to work until their expiration date. When users create a new authorization or renew an existing one, they will go through the updated flow.

What does this mean in practice?
No technical changes are required on the side of an integration partner. During authorization, users will select which API components and permissions are granted to an integration. It is therefore important that the required permissions are selected for the functionality being used.

Requests to API resources for which no permission was granted will return a 403 Forbidden response. Granted permissions can be inspected by decoding the token, making it easier to identify missing permissions.

We recommend integration partners keeping onboarding documentation and customer guidance aligned with the permissions required by the integration.

Permission overview
On the following page you will find an overview of the different scopes and permissions.

Rollout planning
The renewed authorization process will be rolled out in phases. On September 8. The new changes will go live for the following integration partners:

  • EffectConnect
  • ESS
  • FiveX
  • GoedGepickt
  • Staxxer
  • ChannelEngine*
  • MarktMentor*
  • Productsup*

For all other integration partners it will go live on September 22.

*These integration partners already went live as part of a pilot on August 25.

Learn more
For a detailed explanation of the new authorization experience, including screenshots, examples, and guidance for retailers, advertisers, and suppliers, please refer to the article on the Partnerplatform.

Note: Client credentials flow
This change currently only applies to integrations that use Single Sign-On (SSO). Integrations using Client Credentials are not affected at this time.

Tags