# Segment

![Twilio_Segment_Horizontal_Green.jpg](https://assets.relyanceuat.xyz/images/docs/6586729131917/6586716744461.jpg)
Segment is a web-based customer data platform (CDP) service that helps you collect, clean, and control your customer data. It enables developers to collect, transform, send, and archive first-party customer data. Which can then be used by marketing, sales, and customer service leaders with the insights they need to design and build relevant, data-driven customer engagement.

In order to integrate Segment with Relyance AI you will need a Segment **Public Account Token**, **Profile Token (optional)**, and **Space ID (optional)**.

#### In Segment:

In order to connect to Segment, you will need to create a Public Access Token.

![Segment-4.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/6614801080333.png)

1. Login to your Segment account.
2. Click on the **Settings** menu in the left-hand navigation.
3. Click on **Workspace Settings** from the **Settings** menu.

![Segment-3.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/6614790851469.png)

4. Click on the **Access Management** tab.
5. Click on **Tokens**.

6. Click on **+** **Create Token**.
7. Fill out the token details and then click **Create**.
8. Copy the **Public Account Token** to be used in Relyance AI.

![Segment-5.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/6614886585869.png)

![Segment-6.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/6614984924685.png)

The following **optional** steps require you to have the Segment Business plan subscription. This allows access to a second Profile API.

#### Add the Profile API (optional)

1. Click **Profiles** from the left-hand navigation menu and select **Profiles Settings** below it.
2. From this page select the **API Access** tab.
3. Click on the **+** **Generate token** button.
4. Provide a meaningful name and click the **Generate token** button in the dropdown dialog.
5. This will provide you with both your **Profile Token (1)** and **Space ID (2)**.

![Segment-7.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/11675481466125.png)

#### Data Subject Requests (DSRs)

![Segment-9.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/11674410123021.png)
The Segment DSR module for Relyance requires both the **Public Access** and **Profile API Tokens** (and **Space ID**). One additional setup step is required to resolve the email addresses provided by the client during for a Data Subject Request to a Segment ID. This allows us to execute the DSR on your behalf.

1. Click **Profiles** from the left-hand navigation menu and select **Profiles Settings** below it.
2. Once there, you should be on the **Identify resolution** tab. If email is already in the Identity resolution tab, you can skip this part (steps 3-6).
3. Click the **+ Add Identifier** button and select **Default identifiers** from the dropdown.
4. Select **email** and click **Continue**.
5. In the next dialog screen select **Add Identifiers**.

![Segment-10.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/11674391294861.png)

6. You should see our new email identifier in the table back on the main tab.

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor Integration** tab.
5. Find the **Segment** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Custom**.
8. Click the **Process DSRs** checkbox if also processing DSRs.
9. Paste the **Public Account Token**, **Profile Token (optional)**, and **Space ID (optional)** into their respective fields.

![Segment-1.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/11674527908877.png)

10. Click **Connect.**
11. At this point, you should see the following result on the Vendor Integrations page:

![Segment-2.png](https://assets.relyanceuat.xyz/images/docs/6586729131917/6587300580877.png)

12. Congratulations, you are now connected to **Segment**.

<!-- failure-modes:begin (generated from the integration catalog; do not hand-edit) -->

## If the connection reports Connected but returns nothing

These are the ways this integration comes back empty without reporting an error. Generated from the integration catalog, so it tracks what the connection actually asks for.

1. **A feature you enabled returns nothing.** Some scopes belong to a feature rather than to the connection: **Data subject requests** needs `Grant PII Access`, `Public Account Token`. Turning the feature on after the connection exists does not widen the grant it already holds, so re-authenticate the connection.
2. **A credential rotated at the vendor is not picked up here.** **Public Account Token** and **Profile Token** are stored when you save the connection, so regenerating the value at the vendor breaks the next scan until it is re-pasted here. Recording the expiry on the connection means Relyance warns you before it lapses.
3. **Check the address fields before suspecting the credentials.** **EU instance** identifies which tenant, region or host to talk to. A wrong value there fails authentication and looks exactly like a bad secret.

<!-- failure-modes:end -->

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Custom** | `EU instance` (secret), `Public Account Token` (secret) | `Profile Token` (secret), `Space ID` |

<!-- auth-methods:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "segment" {
  vendor = "segment"
  name   = "<your connection name>"

  auth = {
    method = "access-token"
    params = {
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      eu_instance = "false"
      ACCOUNT_TOKEN = var.segment_account_token
      PROFILE_TOKEN = var.segment_profile_token
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->