A customer's web developer team is creating a form that will leverage a Marketing Cloud...

The installed package must include the proper OAuth Scopes (specifically Read and Write permissions) for Data Extensions. Without these permissions, the API cannot upsert (insert/update) data into DEs. Also, client ID and secret must be kept server-side for security reasons (thus eliminating C).

—

Exact Extract from Salesforce Documentation:

Source: Salesforce Help – Installed Packages Permissions

→ "When creating an installed package for API integrations, you must ensure that the package has the appropriate scopes. To upsert rows into data extensions, grant both Read and Write permissions for Data Extensions."

Source: Salesforce Developer Documentation – Security Best Practices

→ "Never expose client IDs and secrets in client-side code such as JavaScript. These credentials must be kept secure on server-side systems."

—