Custom Activation Setup Guide

Private Beta
Set up Custom Activation as a destination in RudderStack.

Use this guide to set up a Custom Activation destination in RudderStack.

To sync a saved audience to your Custom Activation destination, see How to Sync Audiences to Custom Activation.

Setup

  1. Go to Collect > Destinations > New Destination.
  2. Search and select Custom Activation.
  3. Creating a source is optional. Click Continue to skip this step.
  4. Configure the following settings to specify how RudderStack connects to your API and complete the setup:
Setting
Description
NameA unique name that identifies this destination in your workspace.

Audience delivery API configuration

Setting
Description
Enter base URLSpecify the root URL for your API (for example, https://api.example.com). All requests are sent to this URL.
Need authentication support?Turn this on to authenticate with your API.

See Authentication for details.
Custom headersThis optional setting lets you add extra key-value headers to every request (for example, Content-Type, X-API-Version).

Authentication

Except for No authentication, every method below requires Need authentication support? to be on — you then link an account in the account card.
Method
Description
No authenticationLeave Need authentication support? off — use this for public endpoints only
Basic AuthEnter a username and password
API KeySpecify a header name (for example, X-API-Key) and API key value
Bearer TokenEnter a bearer token value
OAuth 2.0 Client CredentialsMachine-to-machine token — available only when this account option is enabled for your workspace
OAuth 2.0 Authorization CodeAuthorize through your provider in a browser — available only when this account option is enabled for your workspace

Set up Client Credentials

  1. Turn on Need authentication support? and choose Client Credentials in the account card.
  2. Create an account with the account fields, or select an existing one, and link it to the destination.
  3. To change settings or rotate the secret, open the account from the destination’s account card and select Edit account. The Client secret is masked and optional — leave it blank to keep the stored secret, even when you change other settings. The current token stays in use until it expires, so your new settings take effect at the next token refresh.
If you run a hybrid or self-hosted data plane, upgrade rudder-server to a version that supports Client Credentials accounts before you link one. Cloud data planes need no action.
The first event for a new Client Credentials account triggers the token request. That first attempt fails and retries automatically once the token is issued — no action needed.

Set up Authorization Code

  1. Turn on Need authentication support? and choose Authorization Code in the account card.
  2. Copy the Redirect URI shown in the account form and register it in your provider’s app settings. It’s the same URI in all regions, so you only need to register one.
  3. Create an account with the account fields, complete the authorization in the popup, and link the account to the destination.
  4. Use Re-authorize when the provider asks you to reconnect. Authorization Code accounts can’t be edited; to change settings, create a new account and relink the destination.

Enter OAuth account fields

Fill in these fields when creating an account. Don’t put client secrets in URLs, Extra token parameters, or Custom headers.

FieldWhat to enter
Authorization URL (Authorization Code only)Your provider’s HTTPS authorization endpoint.
Token URLYour provider’s public HTTPS token endpoint, without query parameters.
Client IDThe client ID from your provider app.
Client secretThe client secret from your provider app.
ScopesOptional. The scopes your provider requires, one per tag — up to 50 tags, with no spaces or commas inside a tag. Pasting a space- or comma-separated list splits it into tags automatically.
Scope separatorChoose how the tags are joined in the token request: space (default) or comma, as your provider requires. This doesn’t change how pasted tags are split.
Extra token parametersOptional. A URL-encoded form string of up to 2,000 characters (for example, resource=audiences&tenant=example), not JSON. Use only extra fields your provider requires — you can’t set standard OAuth parameters such as grant_type, scope, client_id, client_secret, redirect_uri, refresh_token, response_type, or state. A reserved key makes the token request fail and aborts delivery.
Token authentication methodclient_secret_basic (default) sends the client ID and secret in the Authorization header; client_secret_post sends them in the token request body. Check your provider’s requirements.

OAuth requirements

Your provider’s token endpoint must accept a standard OAuth 2.0 token request and return JSON with an access_token. RudderStack sends it to your API as an Authorization: Bearer header and refreshes it automatically when it expires. Authorization Code accounts without a refresh token can’t be refreshed; use Re-authorize when delivery stops.

Endpoint configurations

Configure how RudderStack adds, updates, and removes audience members:

SettingWhen it runs
Add recordA user enters the audience
Update recordA member’s mapped attributes change.

Set Use Add record configuration to Yes to reuse the same method, path, template, and fields as Add record.
Remove recordA user leaves the audience
Use Add record configuration

Action-specific settings

Each action’s (add/update/remove record) settings follow the same structure.

HTTP method and endpoint path

SettingDescription
HTTP methodPOST, PUT, PATCH, GET, or DELETE for this action.
Endpoint path URLPath appended to the base URL.

It supports simple interpolation with connection values, for example /audiences/{{connection.audienceId}}/members.
The resolved URL is the base URL plus the evaluated endpoint path.

Batch size

SettingDescriptionDefault value
Batch sizeMaximum records per HTTP request for this action. Range 1–50005000

Request body template

Define the JSON body sent to your API. The template follows JSONata syntax.

Templates are validated when you save the destination. An invalid syntax is rejected with an error that identifies the action and issue.

A sample request body template is shown below:

json
{
  "audience_id": $$.connection.audienceId,
  "elements": [$$.records.{
    "userIds": [
      {"idType": "SHA256_EMAIL", "idValue": sha256_email},
      {"idType": "GOOGLE_AID", "idValue": google_aid}
    ],
    "firstName": first_name,
    "lastName": last_name,
    "nested": {
      "org": "static_value"
    }
  }]
}

Global objects available at runtime

Object
Description
$$.recordsArray of records in the current batch (after field processing and hashing)
$$.connectionSync connection metadata, including audienceId

Allowed operations

  • Object and array construction
  • Path expressions ($$.records, $$.connection.audienceId)
  • Iteration with { ... } — for example, $$.records.{ "email": email, "user_id": user_id }
  • String, number, and boolean literals
  • Number() casting where needed, for example,$number($$.connection.audienceId)

Template example

A template for generic batched members is shown below:

json
{
   "audienceId": $$.connection.audienceId,
   "users": [$$.records.{
    "email": email,
     "user_id": user_id
  }]
}

Template fields

After you define a template, RudderStack extracts field names referenced under $$.records and lists them under Template fields. Click Refresh to re-scan the template, or Manage fields to configure each field.

Manage template fields
Field settingDescription
NameDestination-side field name used in the template
RequiredIf enabled, you must map the field to a warehouse column during sync setup
StaticIf enabled, the value is a literal you provide while adding a sync
HashHash algorithm applied before the template runs. You can choose between None, SHA256, SHA512, or MD5.
Configure template fields

If you rename or remove template fields after syncs exist, make sure to update mappings on each affected sync manually.

See Troubleshooting for more information.

Request preview

Use Fetch preview to build a sample HTTP request from test records.

Preview doesn’t call your API or fetch an OAuth token. It renders the Authorization header with a masked value, so you can check the method, URL, and body without exposing a credential.
  1. Choose how many sample records to include (for example, 1 record).
  2. Edit sample data if needed.
  3. Click Fetch preview to see the resolved method, URL, headers, and JSON body.
Fetch preview

Troubleshooting

Issue
Resolution
Template is rejected on saveThe syntax is outside the allowlisted operations — the error message names the action and position
Unexpected payload shapeUse the Fetch preview with the same sample records and action type (INSERT, UPDATE, or DELETE) to verify the payload shape
OAuth delivery failsFor Client Credentials, credentials aren’t checked when you save the account — they’re first used at delivery. Check the token URL, client ID, secret, scopes, and token authentication method. Delivery aborts when your provider rejects the credentials (invalid_grant or invalid_client), returns 401, or when Extra token parameters contains a reserved key; other provider errors are retried. After five consecutive token errors, the last error is returned for about five minutes — editing the account doesn’t reset this, so allow a few minutes after a fix before delivery resumes.
Authorization popup shows an errorMake sure the redirect URI registered with your provider exactly matches the one in the account form.

Next steps

To sync a saved audience to your Custom Activation destination, see How to Sync Audiences to Custom Activation.


Questions? Let's figure it out together.

Join the RudderStack Slack community to connect with other users, customers, and the RudderStack team — or reach out for direct support.