We have an external application which makes calls through the SOAP/REST APIs. Obviously this is through an Integration App Center account linked to our Exact Target account. How do we go about linking to other partner accounts so we can make calls on their behalf? Do they have to provide us with their client/secret? Or is it possible to link other ET accounts through our App Center account without those partners providing us with their credentials? Is there a way to authorize our "integration app"?
Add a comment
|
1 Answer
Primary way to authorize your application is to take it through the HubExchange Program, and have the app approved/listed in HubExchange. More info: http://pages.exacttarget.com/HubExchangePartners/become-a-partner/
Building this type of app in requires selecting type “Marketing Cloud” in the Create New App step within App Center, and specifying the various endpoints and object permissions for your integration. Client ID/Secret are always tied to a unique app… not to a customer’s Marketing Cloud account.
Your app will make calls on behalf of customers when they install your app from HubExchange, and they launch your app from the app switcher. An encrypted JWT payload is sent to the endpoint you specify for your app in App Center. Using your Client ID/Secret/App Signature, your system decodes and receives a payload of user/account information, including the required oauth and refresh tokens you will need to make calls on their behalf. More SSO info: https://code.exacttarget.com/app-development/marketing-cloud-apps/single-sign-on.html
-
Thanks very much for the quick response. One more follow up question. After a third-party authorizes the app, what would I pass to the API to distinguish between third party accounts? Commented Dec 10, 2014 at 22:11
-
The oauthToken returned in the JWT provides the context for the specific Marketing Cloud account.– jwachsCommented Dec 11, 2014 at 16:07
-
Does the client id and client secret get passed in the JWT response? If not, how would I know to refresh the token for a specific account/user? Commented Dec 11, 2014 at 21:26
-
ClientID/Secret is NOT passed in the JWT. That is stored on your side, and is linked to the AppID assigned to your app. AppID is passed in the JWT.– jwachsCommented Dec 15, 2014 at 18:52
-
Clarification from original post: Upon initial receipt of an encoded JWT, you only need App Signature to decode the JWT. The oauthToken in that JWT is enough to make an API call (From link in original answer, check section ‘Decoding the JWT’). When the oauthToken expires, you’ll use refreshToken along with ClientID/Secret to request a new oauthToken (and subsequent refreshToken). (From link in original answer, check section ‘Refresh Token Implementation Restrictions’)– jwachsCommented Dec 15, 2014 at 18:52