Salesforce Marketing Cloud Security Token

Always enforce tls when making calls to the marketing cloud apis.

Salesforce marketing cloud security token.

Protect the access token as you would protect user credentials. Change the time on your server. To get an access token for oauth 2 0 api integrations review set up your development environment for enhanced packages. Follow industry best practices to securely store the refresh token on an external platform.

Plus you re required to use oauth tokens to access these endpoints. It ensures among other things that if a user s account credentials are compromised a third party wouldn t be able to access salesforce via api or from an untrusted network. Call the rest auth service to obtain an access token. Treat the refresh token like a salesforce credential.

Marketing cloud returns an access token. This access token authorizes calls in the account where you created the token. To get those endpoints and tokens you need to do a few things. The marketing cloud user for your integrated account must have the installed package administer permission.

Get an access token for legacy packages. This document applies only to api integrations in legacy packages. Get an access token. This is the same issue as invalid security token the solution was either.

Use the access token to authenticate your soap calls in the header. At salesforce we take security seriously. For your authentication requests we recommend using our tenant specific marketing cloud branded endpoint structure which includes your tenant s subdomain. Keep the access token in memory only and request a new access token when needed.

If using the exact target php soap api and unable to change the time on your server you will need to edit helpers soap wsse php specifically the addusertoken function. Marketing cloud provides tenant specific endpoints to help secure your api requests more on this in a minute. Even small businesses can use marketing automation that will help bring in new customers and nurture the ones they already have without an army of marketers. Your application must extract the access token and store it safely.