# Authorize Requests

When your app requests private data, the request must be authorized by an authenticated
user who has access to that data.

> [!NOTE]
> **Note:** If your app accesses the Bid Manager API, it must pass the [OAuth verification review](https://support.google.com/cloud/answer/7454865#verification). If you see **unverified app** on the screen when testing your app, you must submit a verification request to remove it. Learn more about [unverified apps](https://support.google.com/cloud/answer/7454865) or get answers to [frequently asked questions about app
> verification](https://support.google.com/cloud/answer/9110914).

Every request your app sends to the Bid Manager API must include an authorization token. The token
also identifies your app to Google.

## About authorization protocols

Your app must use [OAuth 2.0](https://developers.google.com/identity/protocols/OAuth2) to authorize requests.
No other authorization protocols are supported. If your app uses [Google Sign-In](https://developers.google.com/identity#google-sign-in), some aspects of authorization are handled for
you.

## Authorizing requests with OAuth 2.0

All requests to the Bid Manager API must be authorized by an authenticated user.

The details of the authorization process, or "flow," for OAuth 2.0 vary somewhat depending
on what kind of app you're writing. The following general process applies to all app types:

1. When you create your app, you register it using the [Google API Console](https://console.cloud.google.com/). Google then provides information you'll need later, such as a client ID and a client secret.
2. Submit an [OAuth verification
   review](https://support.google.com/cloud/answer/7454865#verification) request for your app in order to access the Bid Manager API scope.
3. Activate the Bid Manager API in the Google API Console. (If the API isn't listed in the API Console, then skip this step.)
4. When your app needs access to user data, it asks Google for a particular **scope** of access.
5. Google displays a **consent screen** to the user, asking them to authorize your app for access to some of their data.
6. If the user approves, then Google gives your app a short-lived **access token**.
7. Your app requests user data, attaching the access token to the request.
8. If Google determines that your request and the token are valid, it returns the requested data.

Some flows include additional steps, such as using **refresh tokens** to acquire new access
tokens. For detailed information about flows for various types of apps, see Google's [OAuth 2.0 documentation](https://developers.google.com/identity/protocols/OAuth2).

## OAuth scope

Here's the OAuth 2.0 scope information for the Bid Manager API:

| Scope | Meaning |
|---|---|
| `https://www.googleapis.com/auth/doubleclickbidmanager` | Read/write access. |

To request access using OAuth 2.0, your app needs the scope information, as well as
information that Google supplies when you register your app (such as the client ID and the
client secret).