API22% of the exam
OAuth tokens, installed packages and API headers
How enhanced installed packages issue OAuth 2.0 tokens through the client credentials and authorization code grants, why every token lives in one business unit, and where the token goes on tenant-specific REST and SOAP calls.
Describe the OAuth authentication flow and how an access token is used in SOAP and REST headers.
~7 min read · 19 practice questions ·
What the exam expects
- Tell enhanced from legacy installed packages and say why every new integration is enhanced.
- Build a client credentials token request and read its response: lifetime, scopes, business unit and base URLs.
- Walk the authorization code flow for web and public apps, including redirect URI, code lifetime, scopes and refresh tokens.
- Get a token in the right business unit, and handle business unit switching.
- Place the token correctly:
Authorization: Beareron REST,fueloauthin the SOAP header, or UsernameToken for legacy username and password SOAP clients. - Key terms: installed package (the Setup container whose API Integration component issues the client ID and secret); client credentials grant (server-to-server, no user); authorization code grant (web and public apps acting for a user); account_id (the MID that sets a token's business unit); tenant-specific endpoint (a base URI built on your account's own subdomain).
Key facts
Legacy package creation
- Detail
- Deprecated August 2019
Access token
- Detail
- Up to 512 characters; 20-minute lifetime
expires_in- Detail
- 1080 seconds, to refresh 2 minutes early
Client credentials refresh
- Detail
- No refresh tokens; request a new token
Authorization code
- Detail
- 5-minute lifetime
Refresh token
- Detail
- Default lifetime 30 days
Integration changes
- Detail
- Up to 5 minutes to reach new tokens
Redirect URIs
- Detail
- Up to 10; no wildcards;
https://127.0.0.1:80/locally
Subdomain
- Detail
- Works only with marketingcloudapis.com
SOAP token scope
- Detail
- Doesn't flow down to child accounts
AppExchange
- Detail
- No server-to-server packages; use web or public app
Sources for this section (8)
- Installed Package Typesdeveloper.salesforce.com (opens in a new tab)
- Server-to-Server Tokendeveloper.salesforce.com (opens in a new tab)
- Client Credentials Grantdeveloper.salesforce.com (opens in a new tab)
- Authorization Code Referencedeveloper.salesforce.com (opens in a new tab)
- Web and Public App Tokendeveloper.salesforce.com (opens in a new tab)
- Integration Considerationsdeveloper.salesforce.com (opens in a new tab)
- Tenant-Specific Endpointsdeveloper.salesforce.com (opens in a new tab)
- Authenticate SOAP Callsdeveloper.salesforce.com (opens in a new tab)
- When is a web app's access token revoked by default?
- How long does a refresh token last by default?
- Why must an AppExchange app keep the tssd value it receives?
- Where does a username-and-password SOAP client find its SOAP Service Endpoint?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Marketing Cloud Engagement Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (19 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both