In order to interact with Salesforce Marketing Cloud APIs you need to create an installed package in your Marketing Cloud account first. Marketing Cloud uses installed packages to help authenticate users and API requests. To create and install packages you must have the Administrator or Marketing Cloud Administrator role assigned to your profile.

Marketing Cloud has two types of installed packages: packages with enhanced functionality (v2) and packages with legacy functionality (v1). If you’re not sure which package has been installed in your account, check the “Details” tab of your installed package – all legacy packages have a banner at the top indicating that it’s a legacy package and a Licenses tab. Enhanced packages have an Access tab.

Note the Authentication Base URI , Client Id and Client Secret as you will need them to authenticate. Below code examples are meant for Server-to-Server Integrations with Client Credentials Grant Type.

Request access token for a Legacy Package

The following script will allow you to authenticate if you’re using the Legacy Package. As of August 1, 2019, Marketing Cloud has removed the ability to create legacy packages, but you can still use legacy authentication and API requests with existing legacy packages.

You will need to insert the Client Id and Client Secret and your tenant-specific authentication endpoint (Authentication Base URI). Bare in mind, that it is not a good idea to publish Client credentials on a CloudPage.

	<script runat="server">
	Platform.Load("Core","1.1.1");
	var authEndpoint = 'https://mcxxxxxxxxxxxxxxxxxxxxxxxxx.auth.marketingcloudapis.com&#39;;
	var payload = {
	clientId: "insert Client Id",
	clientSecret: "insert Client Secret"
	};
	var url = authEndpoint + '/v1/requestToken';
	var contentType = 'application/json';
	try {
	var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));
	if(accessTokenRequest.StatusCode == 200) {
	var tokenResponse = Platform.Function.ParseJSON(accessTokenRequest.Response[0]);
	var accessToken = tokenResponse.accessToken;
	}
	} catch (error) {
	Write(Stringify(error));
	}
	</script>

view raw sfmc-api-v1-authentication-ssjs.html hosted with ❤ by GitHub

The access token will be valid for 60 minutes and it is issued with the scopes specified on the API integration in Installed Packages. With Legacy Packages, the access token can only be used in the context of the business unit that created the integration.

Request access token for Enhanced Packages

For this package, you will need to insert the Client Id and Client Secret, your tenant-specific authentication endpoint (Authentication Base URI) and define grant_type as "client_credentials" for server-to-server integrations. You can also specify two optional parameters, scope and account_id. If you don’t include the scope parameter in the request, the token is issued with the scopes specified on the API integration in Installed Packages. For a full list of permissions click here. Account ID is the MID of the target business unit. Use this parameter to switch between business units. If you don’t specify account_id, the returned access token is in the context of the business unit that created the integration. Again, bare in mind, that it is not a good idea to publish Client credentials on a CloudPage.

	<script runat="server">
	Platform.Load("Core","1.1.1");
	var authEndpoint = 'https://mcxxxxxxxxxxxxxxxxxxxxxxxxx.auth.marketingcloudapis.com&#39;;
	var payload = {
	client_id: "insert Client Id",
	client_secret: "insert Client Secret",
	grant_type: "client_credentials"
	};
	var url = authEndpoint + '/v2/token';
	var contentType = 'application/json';
	try {
	var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));
	if(accessTokenRequest.StatusCode == 200) {
	var tokenResponse = Platform.Function.ParseJSON(accessTokenRequest.Response[0]);
	var accessToken = tokenResponse.access_token;
	}
	} catch (error) {
	Write(Stringify(error));
	}
	</script>

view raw sfmc-api-v2-authentication-ssjs.js hosted with ❤ by GitHub

The access token has a lifetime of 20 minutes. In the response you will also see the scope, rest_instance_url (your tenant’s REST base URL for making REST API calls) and soap_instance_url (your tenant’s SOAP base URL for making SOAP API calls).

Token type will always be “Bearer”, regardless of the package you are using.

To learn more about Marketing Cloud APIs, visit the Trailhead module Marketing Cloud APIs and the official documentation: Intro to Marketing Cloud APIs.