{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Setup and Authentication","description":"Explore Vistar's APIs and developer tools to automate, integrate and scale your DOOH workflows."},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"setup-and-authentication","__idx":0},"children":["Setup and Authentication"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"introduction","__idx":1},"children":["Introduction"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you send requests to Vistar APIs (application programming interface), you must create a dedicated API user for each account and environment you want to access. Use the API user’s credentials to get a session token and include the token in subsequent requests. This topic explains the setup, authentication process, and connection requirements."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-youll-learn","__idx":2},"children":["What You’ll Learn"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In this topic, you'll learn about:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#Set"},"children":["Dedicated API user setup"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#Session-"},"children":["Session-based authentication"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#Connecti"},"children":["Vistar's session requirements and encryption standards"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"Set"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"dedicated-api-user-setup","__idx":3},"children":["Dedicated API User Setup"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you can use Vistar’s APIs, authenticate with a dedicated API user, similar to a service account, to get a session token. This securely limits your requests to the correct account and environment."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For each account you plan to access through the API, you must create a dedicated user with the API Access role enabled."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use this user ONLY for API access."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A user is tied to one account and one environment. If you work across multiple accounts or across Staging and Production, create separate users for each."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["When you set up the user in Admin, select API Access. To learn about creating a new user, see the DSP Users Management or SSP Users Management topics."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sessions are valid for 8 hours. Reuse your session token across requests rather than creating a new session each time."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"Session-"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"session-based-authentication","__idx":4},"children":["Session-Based Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Vistar’s APIs use session-based authentication. To start an authenticated session, call the session endpoint using your API user’s login credentials (username and password). The API returns a Set-Cookie header containing your session token."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include the session token in the Cookie header of each subsequent request. Some HTTP (Hypertext Transfer Protocol) clients manage session cookies automatically. If yours doesn’t, store the token and add it to the Cookie header manually."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"example","__idx":5},"children":["Example"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The following example shows how to start a session and authenticate a subsequent request."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"create-a-session","__idx":6},"children":["Create a Session"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Send your API user's credentials to the session endpoint:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"POST https://platform-api.vistarmedia.com/api/session\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"email\": \"username\",\n  \"password\": \"mypassword\"\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"get-the-session-token","__idx":7},"children":["Get the Session Token"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The API returns the session token in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Set-Cookie"]}," response header:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"HTTP/1.1 200 OK\nDate: Fri, 01 Aug 2025 14:45:45 GMT\nContent-Type: application/json\nSet-Cookie: tr-production=eyJfcGVybWFuZW50Ijp0cnV1LCJ1c2VyLmlkIjoiSkxPRklwOUJUOVNidFFvNXU1Q1J0USIsInVzZXIuaXNfYWRtaW4i0mZhbHN1fQ.G25kmQ.TIUV2Zvlm3dq5Ss193mlKchG2QU; Domain=.vistarmedia.com; Expires=Fri, 01-Aug-2025 22:45:45 GMT; Secure: HttpOnly: Path=/\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"authenticate-a-subsequent-request","__idx":8},"children":["Authenticate a Subsequent Request"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Include the session token in the Cookie request header:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"GET https://platform-api.vistarmedia.com/api/ssp/v1/advertisers/000lYW0SSFSPuV32udyVpA\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Cookie: tr-production=eyJfcGVybWFuZW50Ijp0cnVlLCJ1c2VyLmlkIjoiSkxPRklwOUJUOVNidFFvNXU1QlJ0USIsInVzZXIuaXNfYWRtaW4iOmZhbHNlfQ.G25kmQ.TIUV2Zvlm3dq5Ssl93mlKchG2QU\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"id":"Connecti"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"connection-requirements","__idx":9},"children":["Connection Requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To protect data in transit, Vistar's APIs enforce the following connection requirements:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use HTTPS with TLS (Transport Layer Security) only."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use TLS versions: 1.2 or 1.3."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use one of the following supported cipher suites:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["TLS_AES_128_GCM_SHA256"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["TLS_AES_256_GCM_SHA384"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["TLS_CHACHA20_POLY1305_SHA256"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ECDHE-RSA-AES128-GCM-SHA256"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ECDHE-RSA-AES128-SHA256"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ECDHE-RSA-AES256-GCM-SHA384"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["ECDHE-RSA-AES256-SHA384"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use HTTP/1.1 or HTTP/2."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["These requirements help ensure your API integration meets modern security standards—protecting your data and your users."]}]},"headings":[{"value":"Setup and Authentication","id":"setup-and-authentication","depth":1},{"value":"Introduction","id":"introduction","depth":2},{"value":"What You’ll Learn","id":"what-youll-learn","depth":2},{"value":"Dedicated API User Setup","id":"dedicated-api-user-setup","depth":2},{"value":"Session-Based Authentication","id":"session-based-authentication","depth":2},{"value":"Example","id":"example","depth":3},{"value":"Create a Session","id":"create-a-session","depth":4},{"value":"Get the Session Token","id":"get-the-session-token","depth":4},{"value":"Authenticate a Subsequent Request","id":"authenticate-a-subsequent-request","depth":4},{"value":"Connection Requirements","id":"connection-requirements","depth":2}],"frontmatter":{"title":"Setup and Authentication","slug":"/apis/setup-and-authentication","seo":{"title":"Setup and Authentication"}},"lastModified":"2026-09-24T21:03:31.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/apis/setup-and-authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}