Is it possible to use OAuth 2.0 for Alexa for Business?

Question

I'm using the Alexa for Business (A4B) API successfully with an Access Key ID and Secret Access Key with the AlexaForBusinessFullAccess IAM policy. However, I'm interested in building an app that other A4B users can use without embedding their Key ID and Key into my app directly.

Is there any way to create an Alexa for Business app that is authorized using an OAuth flow, like a standard Alexa skill?

I'm specifically looking to sync contacts using various A4B contacts APIs including the following:

• CreateContact
• DeleteContact

Information on the API is here but I didn't see anything for OAuth here.

• https://docs.aws.amazon.com/a4b/latest/APIReference/
• https://docs.aws.amazon.com/sdk-for-go/api/

Some information on auth is here:

• https://docs.aws.amazon.com/sdk-for-go/api/aws/session/

I'm using Go but appreciate any info.

Answer 1

Just heard from an Amazon rep that OAuth is not available for the Alexa for Business API due to several reasons. The API must be accessed using IAM credentials or delegate IAM permissions.

Currently, a way to do this is to build a configuration page where users can supply their Access Key ID and Secret Access Key in the app configuration from the IAM console with the requisite AlexaForBusinessFullAccess policy.

It may also be possible to have the app enabled using the A4B console and create an IAM role from "Settings" > "AVS permissions" where the user needs to input the "AVS device maker's AWS account ID" and "Amazon ID".