Evercontact Authentication

generated: '2026-08-14'
method: searched
source: https://www.evercontact.com/api.html
docs: https://www.evercontact.com/api.html
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_in: []
  oauth2_flows: []
  notes: >-
    The REST API authenticates with a bearer token in the Authorization header.
    Live tokens carry an ec_live_ prefix (a sandbox/test mode is offered). Separately,
    end-user data access to Google Workspace and Microsoft 365 mailboxes is granted
    via OAuth consent (validated under Google CASA Tier 2), with instant revocation
    of the OAuth grant by the user.
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearer_format: ec_live_ / ec_test_ prefixed token
  in: header
  header: Authorization
  sources:
  - https://www.evercontact.com/api.html
x-verification:
  checked: '2026-08-14'
  live_challenge_observed: false
  note: >-
    The auth model could not be confirmed against a live response: the published
    API host api.evercontact.com fails TLS (certificate names a Sony load
    balancer) and returns 403 to every path. Note also that a community client
    written against the older Evercontact API used HTTP Basic Auth, so the
    Bearer/ec_live_ model on the current api.html page represents a rebuilt
    surface, not a continuously documented one. No scopes, token lifetime,
    refresh model or key-rotation policy is published.
mailbox_authorization:
  method: oauth2
  providers:
  - Google Workspace
  - Microsoft 365
  assurance: Google CASA Tier 2
  revocation: user-initiated, instant