> ## Documentation Index > Fetch the complete documentation index at: https://developers.criteo.com/llms.txt > Use this file to discover all available pages before exploring further. # Private Market Programmatic Consent Granting > Set up the two-app Admin and Business application model for programmatic consent granting in private market integrations. # Overview The programmatic consent granting process for private market will involve two API applications called the Admin app (client credentials) and the Business app (authorization code) ## Admin App * Is responsible for account creation and consent granting, * Will use the *client credential* workflow, * A retailer admin will grant consent on behalf of a retailer's supply account (using consent portal), * The admin app will use the new "***Accounts***" domain only, to manage accounts programmatically. ## Business App * Will be responsible for all API operations on behalf of private market demand accounts, * Will use the *authorization code* workflow, * Consent will be managed through the admin app, * The business app may manage different business entities from all domains (Analytics, Audience, Campaigns, Catalog) except the "***Accounts***" domain (managed exclusively through the admin app). *** # Admin Application 1. Log into your [partners.criteo.com](https://partners.criteo.com/dashboard/442/apps) account to create the Admin app. In following steps we will need to create a new "Client Credentials" application ## Step 1 . Creating your admin application 1. Begin creating the admin application by providing the app details and click next

2. For the admin application we will be using the Client Credentials as the authentication method. Choose the option and click create

3. Select the C-Max and Retail media as your application service\\

4. Select only the "Accounts" domain and provide manage access

**Information** When selecting the Accounts domain you will be shown the message, **Applications that select “Manage Accounts” will also be granted Campaign Read permissions. This option cannot be combined with any other authorization type.** This is expected and you can just click "Got it" button. Campaign read will be added automatically as it is currently needed to fetch the accounts 3. Click "Activate App" 4. In the App credentials section of your app details, click "Create new key" to download your keys. Store them somewhere safely 5. Generate a consent URL and send it to your account administrator. Users with admin, business manager or technical managers roles are allowed to grant consent. *** # Business Application ## Step 2. Creating your business application Start creating the admin application by providing the app details and click "**Next**":

For the Business Application, we will be using the Authorization Code as the authentication method. Choose this option and click "**Create**"

3. Select "***C-Max and Retail Media***" as your application service 4. Select all relevant authorizations domains that your users will need to access - for more information, check [Create your app](/retail-media/v2027.01-rc/docs/create-your-app#step-3---authorizations): Authorizations for Business Apps

3. Click "***Activate App***" 4. In the App credentials section of your app details, click "**Create new key**" to download your keys. Store them somewhere safely ## Redirect URI In the Redirect URI section of your app details, register the `callbackUrl` where Criteo API will send your authorization code when consent is granted

*** # Demo with Postman In the following demo we will do a simple step by step using Postman ## Step 3. Authenticate the Criteo API with the Admin app 1. Generate a token for your Admin App with the Credentials created in step 1.4. In this step you will need to run a `POST` call to `/oauth2/token`: **Sample Request** ```bash theme={null} curl -X POST "https://api.criteo.com/oauth2/token" \ -d 'grant_type=client_credentials' \ -d 'client_id={ADMIN_CLIENT_ID}' \ -d 'client_secret={ADMIN_CLIENT_SECRET}' ``` **Sample Response** ```json theme={null} { "access_token": "<TOKEN STRING>", "token_type": "Bearer", "expires_in": 900 } ``` **Postman Example** After authenticating you will receive the access token. Use this access token in the next step to grant the account consent

After authenticating you will receive the access token. Use this access token in the next step to grant the account consent

*** ## Step 4. Grant Account Consent 1. Using the token generated in step 3.1, make a `POST` call to the consent grant endpoint. The endpoint should respond with a 204 response status. ```bash theme={null} curl -L -X POST 'https://api.criteo.com/{version}/retail-media/accounts/{demandAccountId}/grant-consent' \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer ' \ -d '{ "data":{ "type": "GrantConsentModel", "attributes": { "clientId": "{BUSINESS_APP_CLIENT_ID}", "callbackUrl": "{BUSINESS_APP_CALLBACK_URL}", // the redirect uri you registered on the partner portal "callbackState": "{DEMAND_ACCOUNT_ID}" // this is an optional parameter but we recommend you pass the account id so you can association it with the right token } } }' ``` ### Grant Consent Attributes * `clientId` - your business client id that was generated in step 2.6 * `callbackUrl` - the redirect uri you registered on the partner portal * `callbackState` (optional) - This is an optional parameter, but we recommend you pass the account` id` so you can associate it with the right token. *** ## Step 5. Exchange Auth. Code Token Linked to Demand Account 1. As soon as you’ve completed step 4.1 you should receive a callback to your callback URL with the code. Use the code to make an addition `POST` call to `/oauth2/token` with code. The business app should use this token to request a pair of access and refresh tokens. ```bash theme={null} curl -L -X POST 'https://api.criteo.com/oauth2/token' \ -H 'Authorization: Bearer ' \ -d 'grant_type=authorization_code' \ -d 'client_id={BUSINESS_APP_CLIENT_ID}' \ -d 'client_secret={BUSINESS_APP_CLIENT_SECRET}' \ -d 'code={CODE}' \ -d 'redirect_uri={BUSINESS_APP_CALLBACK_URL}' ``` **Example**: On the right, after completing step 4.1 our callback URL receives the code. On the left a new POST authenticate call is made with the code

**Example**: On the right, after completing step 4.1 our callback URL receives the code. On the left a new POST authenticate call is made with the code

2. You're now ready to make calls to Criteo API using the Business App *** ### Using the refresh token To renew an access token, use the following request: ```bash theme={null} curl -X POST https://api.criteo.com/oauth2/token \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=authorization_code&code={code}&redirect_uri={redirect_uri}&client_id={client_id}&client_secret={client_secret}" ```

Parameter	Description
`grant\_type=refresh\_token`	Indicates that you are providing a refresh token.
`refresh\_token`	Refresh token shared when requesting an access token.
`client\_id`	Your public key accessible in app credentials section.
`client\_secret`	Your secret key, accessible only once when creating a pair of `client\_id` and `client\_secret` in credentials section.

The response will be the same as when issuing an access token.