Access Tokens

A CMS access token is the credential that lets an organization’s content management system ask CityScreen Context what to play. Every call the content management system makes carries it; the rest of this page says simply access token.

This page is for owner and admin employees, who are the only ones who can regenerate the token, and for the engineers wiring up a content management system.

One token, one organization

An organization has one access token.

Every screen the organization operates presents the same token, and the token is what tells the platform which organization is calling.

The token is created with the organization, so one exists from the day the organization does.

What it covers

Presenting the token authenticates every call the content management system makes, which is the whole content management system surface:

  • The standard ad request and the play reports that follow it.

  • The private-deal path — see Private deals.

  • The ad request calls of the CMS integrations that speak their own dialect: SpinetiX, Cubic Vision and COT.

The token identifies the organization as a whole and grants no access to the client cabinet.

Demand partners report play outcomes using the request identifier the platform issued, without a token.

How it is presented

The content management system sends the token with every request.

A call with an unknown token, or with a token belonging to an organization that has been switched off, is rejected.

A second check on top of the token

Authenticating is not by itself enough to ask about a given organization.

The organization identifier in the request path must match the one recorded in that organization’s own CMS synchronization settings — the value an operator enters when connecting the content management system. A token that authenticates successfully but is used against another organization’s identifier is rejected. See Connect your CMS.

Finding and regenerating the token

The token is shown in the client cabinet under Settings → Agencies (/settings/agencies), labelled the recommendation access token, together with the organization’s identifier and the dates the token was created and last changed.

The identifier shown there is the organization’s GID. The value the request path must carry is the one held in the CMS synchronization settings, which is normally the same — see Synchronization.

Every employee of the organization can read the token there. Only owner and admin employees see the button that regenerates it.

Regenerating the token

  1. Open Settings → Agencies.

  2. Choose the action that generates a new token.

  3. Confirm with your own account password.

Regeneration is immediate and there is no overlap period. The moment the new token is issued the old one stops working, and every screen still presenting it stops receiving answers until the content management system is updated.

Plan the change with the content management system operator, and do it outside the hours the screens are selling.

Regeneration is recorded in the organization’s audit log — see Audit. The token is shown in full on the settings page, so treat that page as you would any other place a live credential is visible.

Confirm who is asking before you give the token to anyone or regenerate it at someone’s request.