About Jimmy_D

Hi @ocreations,   There seems to be some misconception about who the oAuth process is used for and the steps that are needed. The steps you have laid out are incorrect. Let me see if I can clarify how everything should be set up.   Your application is going to be a sign-up form that will be placed on your website. The oAuth process will be used for the account that receives data from the sign-up form. This means the oAuth flow needs to be done only for the single Constant Contact account that gets connected to that sign-up form. The potentially 1000's of people who fill out your sign-up form do not need to go through the oAuth flow.   You listed 10 potential steps in the oAuth process when there are actually only 5 and out of those 5 steps only 1 of them ever needs to be repeated.   Step 1 of our oAuth documentation is used to put together the URL that will eventually generate your Authorization code.   Step 2 doesn't actually have any code on our side. This step is done completely on the developer's side. This is where you take the URL from Step 1 and add it to your application in a way that will direct the user of the sign-up form (remember this will be the Constant Contact account owner, not the people who fill out the form) to a website. They will enter their Constant Contact username/password and click on the Allow button which will give permission to your application to send/receive data to/from their account.   Step 3 is where the redirect URI that you set when creating your API Key is used. After the Allow button is clicked in the previous step the user will be directed to your redirect URI. In the address bar of the browser will be your redirect URI along with the Authorization code appended to the end. This is where you need to your application grab that code to be used in the next step.   Step 4 is where you take the Authorization code from the previous step and make a POST call to our API. You will exchange the Authorization code for an Access Token and a Refresh Token. You will want to store both of these tokens for later use. You no longer need to store the Authorization code.   The above 4 steps only need to occur once for each user of your sign-up form application.   Step 5 is the only step that ever needs to be repeated assuming all of the previous steps were done without errors. Once the Access Token expires you will use the Refresh token to make a POST call to our API. This will generate a new Access Token and Refresh Token. You will then want to replace the old Access/Refresh Tokens with the new tokens. Since the Access Token has a maximum life span of 24 hours you will be repeating this step at least once every 24 hours per user. Again please keep in mind the user of your application is the owner of the Constant Contact account that receives the data from the sign-up form and not the people that fill out the sign-up form. ... View more

Hi @ocreations,   Our v3 API uses standard oAuth2 protocols and is very easy to implement. You have obviously already read the documentation. Once you go through the initial steps and the Access/Refresh Tokens are generated you can then store those for later use. The Access Token is of course used for making API calls and the Refresh Token is used to go through Step 5 of the oAuth flow when when Access Token expires.   Some folks like to automate the refresh process and there are two main ways to do this. One way is to capture the error message that is generated when the Access Token expires and then automatically run through Step 5. The other way is to create a timer that counts the duration of the Access Token. When the timer expires you then go through Step 5. ... View more

Hi @ChristianZ825,   As you are aware you have replied to a four year old post. The custom fields can be use with names you designate when using our v3 API.   The oAuth flow in our v3 API uses the same standard oAuth2 protocols that are used in our v2 API. The difference is in order to ensure higher security we have decided to make the Access Tokens expire sooner than the v2 versions.   As far as how to ensure you always have a valid Access Token I'm not sure why you would have elaborate Cron jobs. There are two main thoughts on this. You can capture the error generated when the token expires and then refresh it with a single call which is in Step 5 of the oAuth flow. The other though on this process is to set up a timer and when the timer expires you automatically refresh the token again using Step 5 of the oAuth flow. ... View more

Hello @YogeshK,   The TLS 1.2 changes have been in place for a long time at this point, if you are having issues related to this I would double check that your servers running your integrations are fully updated to run TLS 1.2.   If you are having other issues with the API please indicate what those error codes are so we can take a look at them. ... View more