# OAuth tokens, installed packages and API headers

*Marketing Cloud Engagement Developer Study Guide · API · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer/api/oauth-tokens-installed-packages-and-api-headers*

How enhanced installed packages issue OAuth 2.0 tokens through the client credentials and authorization code grants, why every token lives in one business unit, and where the token goes on tenant-specific REST and SOAP calls.

- Certification: Salesforce Marketing Cloud Engagement Developer
- Exam section: API
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer

**Official exam objective:**

> Describe the OAuth authentication flow and how an access token is used in SOAP and REST headers.

## What the exam expects

- Tell enhanced from legacy installed packages and say why every new integration is enhanced.
- Build a client credentials token request and read its response: lifetime, scopes, business unit and base URLs.
- Walk the authorization code flow for web and public apps, including redirect URI, code lifetime, scopes and refresh tokens.
- Get a token in the right business unit, and handle business unit switching.
- Place the token correctly: `Authorization: Bearer` on REST, `fueloauth` in the SOAP header, or UsernameToken for legacy username and password SOAP clients.
- Key terms: **installed package** (the Setup container whose API Integration component issues the client ID and secret); **client credentials grant** (server-to-server, no user); **authorization code grant** (web and public apps acting for a user); **account_id** (the MID that sets a token's business unit); **tenant-specific endpoint** (a base URI built on your account's own subdomain).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Legacy package creation | Deprecated August 2019 | [Installed Package Types](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/installed-package-types.html) |
| Access token | Up to 512 characters; 20-minute lifetime | [Server-to-Server Token](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| `expires_in` | 1080 seconds, to refresh 2 minutes early | [Server-to-Server Token](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| Client credentials refresh | No refresh tokens; request a new token | [Client Credentials Grant](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html) |
| Authorization code | 5-minute lifetime | [Authorization Code Reference](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authorization-code.html) |
| Refresh token | Default lifetime 30 days | [Web and Public App Token](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-app.html) |
| Integration changes | Up to 5 minutes to reach new tokens | [Integration Considerations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html) |
| Redirect URIs | Up to 10; no wildcards; `https://127.0.0.1:80/` locally | [Integration Considerations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html) |
| Subdomain | Works only with marketingcloudapis.com | [Tenant-Specific Endpoints](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/your-subdomain-tenant-specific-endpoints.html) |
| SOAP token scope | Doesn't flow down to child accounts | [Authenticate SOAP Calls](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authenticate-soap-api.html) |
| AppExchange | No server-to-server packages; use web or public app | [Client Credentials Grant](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html) |

## Check yourself

- When is a web app's access token revoked by default?
- How long does a refresh token last by default?
- Why must an AppExchange app keep the tssd value it receives?
- Where does a username-and-password SOAP client find its SOAP Service Endpoint?

## Sources

- [Access Token for Server-to-Server Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html)
- [Installed Package Types](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/installed-package-types.html)
- [OAuth 2.0 API Integration Considerations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html)
- [Server-to-Server Integrations with Client Credentials Grant Type](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-s2s-client-credentials.html)
- [Web and Public App Integrations with Authorization Code Grant Type](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-app-auth-code.html)
- [Authorization Code Reference](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authorization-code.html)
- [Access Token for Web and Public App Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-app.html)
- [Tenant-Specific API Endpoints](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/your-subdomain-tenant-specific-endpoints.html)
- [Authenticate Your SOAP API Calls](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/authenticate-soap-api.html)
- [Get an Access Token](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/get-access-token.html)
- [Create a Row in a Data Extension](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/creating_a_row_in_a_data_extension_using_the_web_service_api.html)
- [Stay Secure with Access Tokens (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/marketing-cloud-apis/stay-secure-with-access-tokens)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 19 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Developer pack (USD $19): https://www.certifyforce.com/practice-exams