Salesforce Marketing Cloud Authentication

generated: '2026-08-13'
method: searched
source: openapi/salesforce-marketing-cloud-*-openapi.yml (derived baseline)
docs: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authentication.html
note: Upgraded from derived to searched on 2026-08-13. The captured OpenAPI declares only the clientCredentials flow; Salesforce's docs additionally document an authorization code flow for web and public
  apps, plus the token-response fields that make this API workable — most importantly rest_instance_url and soap_instance_url, which are how a client discovers its own tenant hosts. A client that hardcodes
  a subdomain instead of reading these is doing it wrong.
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  api_key_in: []
  mutual_tls: false
  openid_connect: false
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://{subdomain}.auth.marketingcloudapis.com/v2/token
    scopes: 0
    integration_type: Server-to-Server
    docs: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html
  - flow: authorizationCode
    tokenUrl: https://{subdomain}.auth.marketingcloudapis.com/v2/token
    integration_type: Web and Public App
    docs: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html
    note: '''Web and Public App Integrations with Authorization Code Grant Type.'' Declared in the docs but NOT declared in any captured OpenAPI, which only models clientCredentials.'
  description: Marketing Cloud Engagement uses OAuth 2.0. Credentials come from an API Integration inside an Installed Package created in Marketing Cloud Setup > Apps > Installed Packages. The Installed
    Package also fixes which scopes the integration may ever hold.
  sources:
  - openapi/salesforce-marketing-cloud-assets-api-openapi.yml
  - openapi/salesforce-marketing-cloud-contacts-api-openapi.yml
  - openapi/salesforce-marketing-cloud-journeys-api-openapi.yml
token_request:
  method: POST
  path: /v2/token
  host: https://{subdomain}.auth.marketingcloudapis.com
  fields:
  - name: grant_type
    required: true
    value: client_credentials
  - name: client_id
    required: true
  - name: client_secret
    required: true
  - name: scope
    required: false
    description: Space-separated permissions list.
  - name: account_id
    required: false
    description: Business unit MID. "For server-to-server integrations that use the client credentials flow, specify the MID in the account_id parameter of your v2/token request."
token_response:
  fields:
  - name: access_token
    description: Acts as a session ID that the application uses to make requests. Max 512 characters.
  - name: token_type
    value: Bearer
  - name: expires_in
    value: 1080
    description: '"The value has the value 1080, representing 1,080 seconds, or 18 minutes." The real token lifetime is 20 minutes; expires_in is deliberately reported short so a client refreshes before
      expiry.'
  - name: rest_instance_url
    description: The REST API base URL for this tenant. Use this rather than constructing the host.
  - name: soap_instance_url
    description: The SOAP API base URL for this tenant.
  - name: scope
    description: The permission values actually assigned to the token.
request_header: 'Authorization: Bearer <access_token>'
tenancy:
  subdomain_required: true
  subdomain_source: Marketing Cloud Setup > Apps > Installed Packages
  note: Auth, REST and SOAP each live on a different tenant host ({subdomain}.auth / .rest / .soap .marketingcloudapis.com). There is no global host.
authorization_model:
  scope_grant: installed-package
  runtime_scope_request: false
  note: Scopes are assigned to the Installed Package by an administrator and are fixed for that integration. The scope parameter on the token request can only narrow what the package already holds; it cannot
    request anything new. A 403 with an errorcode in the 20000 class is therefore an administrative problem, not a client one — it cannot be resolved in code.
  artifact: scopes/salesforce-marketing-cloud-scopes.yml
mcp_authentication:
  differs: true
  model: OAuth 2.0 authorization code with PKCE (S256), dynamic client registration
  note: The MCE MCP server does NOT use the marketingcloudapis.com auth host. It runs its own authorization server with RFC 8414 metadata, an RFC 7591 registration endpoint and PKCE. See mcp/salesforce-marketing-cloud-mcp.yml
    and well-known/salesforce-marketing-cloud-oauth-authorization-server.json.
legacy:
  v1_endpoint: https://{subdomain}.auth.marketingcloudapis.com/v1/requestToken
  status: superseded
  note: The legacy ExactTarget token service. New integrations use v2.
docs_pages:
  overview: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authentication.html
  integration_types: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html
  server_to_server: https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html
  scopes: https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_rest_permission_scopes/rest-permissions-and-scopes.html