Setting up the AEM Asset Selector integration

This feature is in alpha testing! Please reach out to spencer@knak.com if you have any questions.

Connect your Knak account to Adobe Experience Manager as a Cloud Service (AEMaCS) so authors can browse and insert approved AEM assets directly into Knak emails and landing pages.

This guide is for the AEM Asset Selector integration, which embeds Adobe's native Asset Selector widget inside Knak. If you are setting up the legacy AEM Assets integration, please see Setting up the Adobe Experience Manager integration instead.

Before You Begin

You will need:

An active AEM as a Cloud Service subscription.
Access to the Adobe Developer Console for your organization (to request the Asset Selector credentials from Adobe).
An AEM administrator with access to your AEMaCS Git repository and Cloud Manager — they will need to commit a configuration file and run a Config Pipeline.
Knak admin permissions on your Knak account.
Dynamic Media (Classic or OpenAPI) enabled for the AEM account.

Setup is split across three roles:

Adobe provisions an IMS Client ID for the Asset Selector.
Your AEM administrator allow-lists that Client ID in each AEM environment.
Your Knak admin enters the credentials in Knak and picks a delivery tier.

Step 1: Request credentials from Adobe

Reach out to your Adobe account team and ask them to provision the AEM Assets Selector for your organization. Adobe will provide the following values — you will need them in Step 2 and Step 3:

IMS Client ID — identifies the Asset Selector application for your org (e.g. aemcs-knak-assetselector)
IMS Organization ID — your Adobe Organization ID (e.g. XXXXXXXXXXXXXXXX@AdobeOrg)
Repository ID — the hostname of your AEM author tier (e.g. author-pXXXXX-eXXXXX.adobeaemcloud.com)
IMS Scope (optional) — the default Asset Selector scopes are almost always correct; Adobe will tell you if anything custom is required

Important Note: This step is a hard prerequisite. Without Adobe provisioning the Client ID, the Asset Selector cannot authenticate, and you will see 403 or Network Error responses when you try to use it.

Step 2: Allow-list the Client ID in your AEM repository

Your AEM administrator must allow-list the Client ID in each AEMaCS environment (dev, stage, prod) that Knak needs to see. Skipping this step is the most common cause of 403 Forbidden errors during setup.

Clone the environment's Git repository.
Create a file at config/api.yaml with the following contents, replacing <provided-clientId> with the Client ID Adobe provided:

  kind: "API"
  version: "1" 
  metadata:   
      envTypes: ["dev"]  # or ["stage"] / ["prod"] for other environments 
   data:                
    allowedClientIDs:    
      author:      
         - "<provided-clientId>"

Commit and push the change.
In Cloud Manager, create a Config Pipeline targeting this repository and branch.
Run the pipeline. Once it completes, the Client ID is allow-listed and the Asset Selector can reach the author tier.

Important Note: Only the author: entry is required. The Asset Selector talks to the author tier for browsing and hands off to the delivery tier for the public URL — the delivery tier does not require this configuration.

For Adobe's reference, see Introduction to CI/CD Pipelines.

To find the above page, follow these steps:

Navigate to the repositories page under the desired program. The page should look like this:
Click on “Access Repo Info”. That will give you the username, password, and repository URL that you need.
In a terminal, using git clone the repository, follow the steps above, and push after the yaml was added

Step 3: Connect the integration in Knak

Open Knak and go to the Admin section.
Under Integrations, click Platforms.
Under Digital Asset Management, select the Adobe Experience Manager Asset Selector tile.
Fill in the fields using the values Adobe provided in Step 1. For the Dynamic Media Delivery field - see Step 4.
Click Create New Integration.

Step 4: Choose a delivery tier

The Dynamic Media Delivery dropdown controls how Knak builds the public URL for an asset the author selects. There are two options:

OpenAPI (AEM as a Cloud Service) — the default. Use this if you are on AEMaCS and use Adobe's Assets delivery OpenAPI. This is correct for most customers.
Scene7 (Dynamic Media Classic) — use this only if your organization delivers assets through Dynamic Media Classic (Scene7). You'll know if you do — Scene7 has its own dashboard and a dedicated domain.

Not sure which to pick? Leave it on OpenAPI and test with an approved asset. If the URL doesn't load, ask your AEM administrator whether Scene7 is the delivery path for your environment, then switch the dropdown. Both options need to be explicitly enabled on your instance.

Step 5: Approve and publish your assets

The Asset Selector shows every asset in your repository, but Knak will only accept assets that are:

An image — anything that isn't image/* (such as PDFs or video) is blocked on selection.
Published and approved — the delivery URL must be publicly reachable. If the asset has not gone through your approval and publishing workflow, the URL will 404 and the author will see an error.

If you chose the Scene7 delivery tier in Step 4, each asset must also be fully synced to Dynamic Media with a publish status of PublishComplete.

Tip: Run your approval and publish workflow on the assets you want Knak to use before authors try to insert them. Troubleshooting is much easier when the Selector and the delivery tier agree on what's live.

Step 6: HTTPS and network requirements

Adobe's IMS authentication and Asset Selector widget only run over HTTPS. Knak already runs over HTTPS, so there is nothing to change on our side — but if your network blocks third-party scripts, iframes, or API calls, have your IT team allow traffic to:

experience.adobe.com — loads the Asset Selector JavaScript library
*.adobeaemcloud.com — your author and delivery tier hostnames (repository discovery, asset metadata, public URL delivery)
Adobe IMS / Adobe ID sign-in domains (e.g. ims-na1.adobelogin.com, auth.services.adobe.com)

If your organization enforces a strict Content Security Policy in the browser, confirm that script-src, connect-src, img-src, and frame-src allow the Adobe domains above.

Using the integration

Once setup is complete, authors can access AEM assets anywhere in Knak that supports image insertion:

Inside an email or landing page, open the image picker.
Select Adobe Experience Manager Asset Selector.
Sign in with your Adobe ID on first use. Your session is remembered for subsequent uses in the same browser.
Browse the folder tree, select an approved image, and click Select.
Knak validates the delivery URL and inserts the asset. An error is shown if the asset is not an image, not published, or not reachable.

Troubleshooting

"Network Error" or 403 Forbidden when opening the Asset Selector. The IMS Client ID has not been allow-listed in your AEM repository. Re-check Step 2: confirm config/api.yaml exists on the correct branch, the Client ID matches Adobe's value exactly, and the Config Pipeline was run successfully for the environment you are testing.
"Authentication failed. Please try again." Adobe IMS rejected the sign-in. Verify that the IMS Client ID and IMS Organization ID in Knak match what Adobe provided (watch for trailing spaces), and that the user signing in belongs to the same Adobe Org. If you set a custom IMS Scope, try clearing it and saving again.
"This asset is not available for public delivery. Ensure it is approved and published in AEM." You are on the OpenAPI delivery tier and the selected asset is not reachable publicly. Ask your AEM administrator to run the asset through your approval and publish workflow, and confirm the OpenAPI delivery endpoint is enabled for your environment.
"This asset is not available via Scene7." / "The Scene7 delivery URL is not reachable." You are on the Scene7 delivery tier. Confirm the asset has been synced to Dynamic Media with status PublishComplete, and that your environment actually uses Scene7 for delivery. If it does not, switch the Dynamic Media Delivery dropdown back to OpenAPI.
"Failed to load AEM Asset Selector. Please try again." The Adobe-hosted Selector script did not load. Check your browser console for blocked requests to experience.adobe.com. If your company enforces a Content Security Policy or corporate web filter, have IT allow the Adobe domains listed in Step 6.
Unpublished or non-image assets appear in the browser. Adobe's Asset Selector UI does not support filtering by custom properties, so every asset in the repository is visible. Knak enforces the image and publish checks at selection time, so invalid assets cannot be inserted even if they show up in the browser. To keep the experience clean, point authors at folders that contain only approved imagery.