# Securing API credentials, users and passwords

*Marketing Cloud Engagement Developer Study Guide · Security · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer/security/securing-api-credentials-users-and-passwords*

Security practices a developer applies: keeping client credentials and tokens server-side, reusing tokens instead of requesting one per call, API users and the inactivity setting, Salesforce's recommended session, lockout and password values, export allowlists, and firewall and partner IP ranges.

- Certification: Salesforce Marketing Cloud Engagement Developer
- Exam section: Security
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer

**Official exam objective:**

> Describe security best practices in Marketing Cloud.

## What the exam expects

- Keep client IDs, client secrets and access tokens out of browser and mobile code, and store them server-side.
- Reuse access tokens for their lifetime and refresh them before they expire, instead of requesting one per call.
- Set up API users so security settings such as Login Expires After Inactivity don't break integrations.
- Apply Salesforce's recommended values for session timeout, lockout, usernames, passwords and export allowlists, and know what a lockout blocks.
- Allow the right Salesforce IP addresses and domains on corporate firewalls, and have partners publish their own ranges for customer allowlists.
- Key terms: **client credentials** (the client ID and secret of a server-to-server API integration); **access token** (acts as a session ID for API requests); **API user** (a user flagged for XML, SOAP and REST API access); **lockout** (blocked access after too many wrong passwords); **export email allowlist** (addresses allowed to receive data exports).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Client ID and secret | Never in client-side JavaScript or a mobile app | [Access Token for Server-to-Server](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| Token lifetime | 20 minutes; `expires_in` 1080 seconds | [Access Token for Server-to-Server](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html) |
| Inactivity expiry | 90 days or fewer; not recommended with API users | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5) |
| Lockout | 3 attempts; admin unlock needed before an activation code | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5) |
| Passwords | Minimum length 8 or more; history 8 or more; expire 90 days | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5) |
| Session timeout | 20 minutes | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5) |
| Firewall list | Allow the entire set; check quarterly | [IP Addresses for Allowlists](https://help.salesforce.com/s/articleView?id=mktg.mc_es_ip_addresses_for_inclusion.htm&type=5&language=en_US) |

## Check yourself

- Why does Salesforce say each extra password character matters?
- When does a short session timeout protect an account?
- What does the API User flag on a user record control?
- Why should a firewall rule for Salesforce IP addresses be reviewed on a schedule?

## Sources

- [Access Token for Server-to-Server Integrations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html)
- [Security Settings and Tools for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5)
- [OAuth 2.0 API Integration Considerations](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/integration-considerations.html)
- [IP Addresses for Inclusion on Allowlists in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_es_ip_addresses_for_inclusion.htm&type=5&language=en_US)
- [Modify User Preferences](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_modify_userpref.htm&type=5&language=en_US)
- [Enable and Configure the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mc_overview_enable_allowlisting.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Developer pack (USD $19): https://www.certifyforce.com/practice-exams