Which authentication method does an enhanced Marketing Cloud App package use to acquire an access token on behalf of a user?

Which authentication method does an enhanced Marketing Cloud App package use to acquire an access token on behalf of a user?

• A. OAuth 2.0 integration using the v2/userinfo REST endpoint to obtain an access token and user information
• B. JWT-based server-to-server flow
• C. API Key in the header
• D. Basic authentication with username and password

Answer: (A)

OAuth 2.0 with user consent is the mechanism for an enhanced Marketing Cloud App Package to act on behalf of a specific user. In this flow, the app redirects the user through an authorization step, and then uses the v2/userinfo endpoint as part of that process to obtain the access token tied to that user along with the user’s identity. This ensures the app can perform actions using the user’s permissions and can tailor behavior to who is signed in. This approach is the right fit because the scenario requires acting with a user’s authorization and context. A JWT-based server-to-server flow would issue a token for the app itself without a specific user, which isn’t suitable when the app must operate on behalf of a person. API keys in headers bypass OAuth and don’t provide per-user authorization, and basic authentication with a username and password is insecure and not how enhanced App Packages are designed to authenticate.

OAuth 2.0 with user consent is the mechanism for an enhanced Marketing Cloud App Package to act on behalf of a specific user. In this flow, the app redirects the user through an authorization step, and then uses the v2/userinfo endpoint as part of that process to obtain the access token tied to that user along with the user’s identity. This ensures the app can perform actions using the user’s permissions and can tailor behavior to who is signed in.

This approach is the right fit because the scenario requires acting with a user’s authorization and context. A JWT-based server-to-server flow would issue a token for the app itself without a specific user, which isn’t suitable when the app must operate on behalf of a person. API keys in headers bypass OAuth and don’t provide per-user authorization, and basic authentication with a username and password is insecure and not how enhanced App Packages are designed to authenticate.