Our site uses forms to collect emails of interested parties and eventually desires to place them into a CC list. After creating an approved app with an API Key and Redirect Url, I'm following the OAuth2.0 Server Flow (https://v3.developer.constantcontact.com/api_guide/server_flow.html) I'm curious: This flow seems to assume our UI will be authenticating, which isn't applicable. Precisely: I'm receiving form UX code from "https://api.cc.email/v3/idfed" instead of something non-interactive. We simply want to deploy this component sometime in the future (perhaps days) on a server and have it insert contacts into a particular CC list. It seems like CC is missing an example of this. I'm happy to follow the OAuth2 flow, but we won't have a browser/user in this flow in our architecture; it's just our server-side component. We desire to use CC from our own servers via a shared-secret mechanism. Questions: 1: Is there another pre-deployment interactive step I need to get an authorization code? 2: Also, it seems like authorization codes expire. Do we have to constantly refresh authorization with the renewal code, even if our site is not actively collecting emails? 3: Overall, this seems like OAuth2 is not the correct security solution for B2B style API usage here. What is Constant Contact's recommended solution for this architecture? Thanks Jim
... View more