Which statement about the OAuth 2.0 integration in the enhanced Marketing Cloud App is true?

• A. It uses a JWT-based workflow to fetch a user token
• B. It relies on the v2/token endpoint to obtain an access token
• C. It uses a legacy API key for user authentication
• D. It uses the v2/userinfo REST endpoint to acquire an access token on behalf of a user and to retrieve user information

Answer: (D)

OAuth 2.0 in the enhanced Marketing Cloud App is designed around using the v2/userinfo endpoint as the main touchpoint for authenticating the user and pulling their details. In this flow, the user signs in and, through this endpoint, the app obtains an access token on behalf of the user while also retrieving the user's profile information in one cohesive step. This aligns with how OpenID Connect-style flows surface the authenticated user’s identity and claims via the userinfo endpoint, making it the central mechanism for validating who’s signing in and for obtaining their data for further API calls.

The other options don’t fit the described integration as neatly: a separate token endpoint is the usual place to obtain tokens, a legacy API key isn’t part of the OAuth 2.0 pattern, and while a userinfo call returns user data, it’s not the standard flow used to issue the token itself outside of this particular enhanced implementation.