Demandbase APIs use the OAuth 2.0 client credentials flow for authentication. Before you can access API data, you must obtain API credentials, generate an access token, and include that token in every API request.
Important: Access token revocation is not currently supported.
Step 1: Obtain API Credentials
After your organization signs the API License Agreement, Demandbase provides the following credentials:
- Client ID
- Client Secret
The Client Secret is confidential and should be stored securely on your server. Do not expose it in client-side applications or share it publicly. For your responsibilities regarding credential security, see your API License Agreement.
The Client ID identifies your organization and can be safely included in API requests because it cannot be used without the corresponding Client Secret.
If you need API credentials, contact your Demandbase Account Team.
Step 2: Generate an Access Token
Use your Client ID and Client Secret to request an access token. API requests are authenticated using the access token rather than your API credentials.
Access tokens provide additional security because they:
- Can be revoked independently if compromised.
- Have usage limits that help protect both your organization and the Demandbase API from excessive requests.
See New Token endpoint.
Step 3: Authenticate API Requests
nclude the access token with every HTTP request (GET, POST, PUT, or DELETE) to authenticate and authorize access to the API.
Demandbase monitors API usage for each access token. If a token exceeds its configured rate limit, requests using that token are temporarily blocked until the throttling period expires.