Using the New Adobe I/O OAuth Server-to-Server Credential Type

Owned by Nathan Jackson
Last updated: May 28, 2024
4 min read

Adobe has started migrating from the old style of JWT credentials to the new OAuth Server-to-Server credential style. As part of this process, the ability to create new JWT credentials will be phased out according to the dates Adobe has provided in this document. Currently, it is still possible to renew JWT credentials in the existing style, but this will be phased out in Summer 2024 (dates have shifted a few times, see link for exact dates), and it will no longer be possible to use JWT credentials past January 27, 2025 regardless of expiration date.

 

As of April 16, 2024, Apollo supports the ability to use OAuth credentials. Current users should undertake the update process as soon as possible to ensure continuous operation and allow time for testing.

 

Upgrading an Existing Adobe I/O Project

You have the option to upgrade an existing Adobe I/O project or create a new one. If you have a currently functional project, the easiest path is to upgrade your current project to use the new credential style. To do this, follow the steps starting about halfway down this page from the Adobe documentation. All of the instructions apply, but wait to delete the old credentials until you test the new ones in Apollo (process listed in next paragraph.) Note that by upgrading an existing project, you will retain the same client ID, technical account details, APIs, scopes, and product profiles, which is a good thing since these have already been set up appropriately for Apollo!

 

Reflecting the Updates in Apollo

When you have upgraded your project in Adobe I/O, you can add a new connection by clicking the settings cog in the upper left of the top navigation within Apollo. Go to the Connections areas and select "Add Another Connection." You will be prompted to enter the following information:

 

 

  • Connection Name: The name of your choice to describe this set of credentials

  • Adobe I/O Client ID: copy from the I/O project credentials

  • Adobe I/O Client Secret: copy from the I/O project credentials

  • Adobe I/O Organization ID: copy from the I/O project credentials

Note that a private key is no longer necessary with the OAuth Server-to-Server credential style, as access is evaluated in real time and does not rely on the private key strategy. This field is thus no longer present in the new connection fields within Apollo.

 

The "Make Default" checkbox is checked automatically. Leave it checked and perform a test deployment, which will rely on the new credentials.

 

Evaluating Your Test Deployment

If the Tag Manager (Adobe Launch) and Data Destination (Adobe Analytics) deployments succeed with a green check mark, you can remove the old JWT credentials within the I/O project that you have upgraded and retain only the OAuth credentials. If you run into any issues but were successfully deploying before, it is possible to delete the new credentials and continue to use your old JWT credentials. Note that existing credentials will keep the old fields including the private key box, whereas newly created credentials within Apollo will have the new field style for the OAuth credential fields only.

 

If you encounter any issues you cannot resolve after ensuring the appropriate product profiles and permissions are applied, please reach out to us at support@apolloplatform.com with any questions.

 

Creating a New Adobe I/O Project with OAuth Credentials

Navigate to http://adobe.io

Click on "Console" in the upper right corner and sign in as needed

Select "Create New Project"

Select "Add API"

You will need to add the following APIs one at a time:

  • Experience Platform API (under Adobe Experience Platform)

  • Experience Platform Launch API (under Adobe Experience Platform)

  • Adobe Analytics (under Experience Cloud)

When prompted, select the OAuth Server-to-Server Credential type. Hit "Next" and select the Product Profiles that allow Apollo access to the necessary report suites and permissions to be able to publish to Analytics and Launch. If a product profile does not currently exist with the necessary permissions, complete the I/O project creation process with an existing product profile, then afterwards create a new product profile with the appropriate permissions in the Adobe Admin Console (different area than Adobe I/O; if you do not have permission to do so, work with your Adobe administrator to do this.) Once the new product profile is created, go back into the I/O project and select it for the API with which it should be associated. If you have questions on appropriate permissions after reviewing these details, please reach us at support@apolloplatform.com. A successful implementation will allow you to create an Apollo Deployment that produces a green checkmark in the Tag Manager (Adobe Launch) and Data Destination (Adobe Analytics) areas.