Connect Adobe Campaign
You create an OAuth Server-to-Server credential in an Adobe Developer Console project, then paste your tenant, that credential’s client id and its client secret into MarqIQ. MarqIQ mints its own Adobe token from that pair and replaces it before each expiry, so nothing needs renewing by hand. If you hold an access token and cannot reach the secret, you can connect with the token instead — that connection dies within 24 hours, and this article says what breaks when it does.
Before you start
Plan required
Adobe Campaign is a Pro tool. On a lower plan the connect request comes back as "Adobe Campaign is part of the Pro plan — this workspace is on Starter", naming your plan. Pro allows one tool from the marketing-automation category, so where Marketo, Pardot, Mailchimp, Salesforce Marketing Cloud or Adobe Journey Optimizer is already connected, the refusal names that tool and points at Business. Disconnect it, or move to Business.
Permissions required
You need somebody who can open your organisation’s Adobe Developer Console, add the Adobe Campaign Standard API to a project, and generate an OAuth Server-to-Server credential. That credential’s technical account must be entitled to your Campaign instance. A read-only Campaign product profile is enough — MarqIQ only ever issues GETs.
- Your Tenant — the name in your Campaign address, the "myorg" in mc.adobe.io/myorg. Either form is accepted in the box.
- Your API Key — the OAuth Server-to-Server Client ID, at developer.adobe.com/console under your project → Credentials → OAuth Server-to-Server → Client ID.
- Your Client Secret — the secret on that same credential, at developer.adobe.com/console. Adobe reveals it when it is generated.
There is no JWT step
Adobe retired the JWT credential type and MarqIQ has never accepted one. If an older instruction tells you to generate a private key and exchange a JWT for a Bearer token, ignore it — that path does not connect.
Get the credential in Adobe
Open the Adobe Developer Console at developer.adobe.com/console
Open the project you want to use, or create one.
Add the Adobe Campaign Standard API to that project.
Without the Campaign API on the project, Adobe may still issue a token and Campaign then refuses every call.
Generate an OAuth Server-to-Server credential.
Adobe issues it carrying five scopes — `openid`, `AdobeID`, `read_organizations`, `additional_info.projectedProductContext` and `session`. MarqIQ sends that set unchanged on every token request. Leave it as Adobe set it: remove one in the Console and Adobe refuses the whole token, so trimming the set costs you the connection rather than narrowing it.
Copy the Client ID.
This one value does two jobs. MarqIQ sends it as Campaign’s X-Api-Key header and uses the same string as the OAuth client id when it asks Adobe for a token.
Copy the Client Secret.
It begins `p8e-`. Adobe shows it at generation time.
Check the credential’s technical account is entitled to your Campaign instance.
MarqIQ’s code never names a product profile or a role, so it cannot tell you which to pick. A credential Adobe will not mint a token for stops at "Adobe IMS refused to issue a token"; one that gets a token but has no Campaign entitlement stops at "Forbidden".
Connect it in MarqIQ
Go to Integrations and choose Adobe Campaign.
Type your tenant into Tenant.
MarqIQ strips `https://` and the `mc.adobe.io/` prefix, then requires what is left to be letters, numbers, dashes or underscores. A tenant carrying a dot or a slash is refused before any call is made, so a look-alike host cannot be smuggled in alongside your key.
Paste the Client ID into API Key.
Paste the secret into Client Secret.
If the secret is out of reach, click Only have an access token? and paste a generated token into Access Token instead. Read the warning below before you do.
Click Connect Adobe Campaign.
MarqIQ mints a token from your client id and secret, then reads one profile from your tenant to prove the key reaches it. Nothing is saved until both succeed.
If Adobe Campaign is already connected, the button reads Update credentials instead.
Leave the tab open while the first sync runs.
Connecting starts the sync on its own. The chunk loop runs in your browser, so the status line says "keep this tab open". Close the tab and the run stops where it is. The next run, manual or scheduled, carries on from the saved cursor.
Read the result line.
A first load finishes with "Fully synced — N records". Later runs say "Up to date — N changes since your last sync". Hold N against your own profile list in Campaign.
An access token connection stops within a day
Connect with Access Token and MarqIQ treats it as having 23 hours left, and shows an amber notice the moment you connect: "Connected with a temporary access token: it expires within 24 hours and scheduled syncs will stop. Reconnect with the client secret for a lasting connection." A line repeats it in every sync log. Nothing on the connection card afterwards says which of the two you used, so the sync log is where to check. Nothing in MarqIQ can renew that token.
Note
The very first sync in a new workspace can report that the workspace’s database has only now been created and that nothing was synced in that run. Click Sync now, or leave it — the sync starts again on its own within the hour.
What comes across
- One profile at connect time, read purely to prove the key reaches the tenant you typed.
- Profiles, read from the extended profile resource, so your organisation’s own custom attributes arrive alongside Adobe’s standard ones.
- On each profile: email, first and last name, company, job title, origin, the blocklist and email opt-out flags, the created and last-modified dates, and the address fields under location — flattened one level, so a country code becomes a plain field.
- The profile resource’s attribute list: every attribute’s name, label and type. Your Campaign attributes are discovered rather than assumed.
- Whether your tenant’s profile resource offers a last-modified filter, which decides whether a sync can read only what changed.
- One label out of the profile resource’s metadata, used to name the connection on this page.
What is dropped on purpose
Only profiles are synced. Services are not, and a profile’s subscriptions, preferred language, time zone, CCPA opt-out flag and its own externalId column are dropped rather than stored. MarqIQ keys each record on the profile’s PKey instead.
What MarqIQ writes back
Nothing. MarqIQ never writes to Adobe Campaign — no profile is altered, added to or removed by this connection. Your credential may well be entitled to write in Campaign; MarqIQ has no code that uses that.
That includes the tracking attributes. MarqIQ cannot make a custom profile attribute for you: a request asking it to answers "Adobe Campaign custom attributes must be created through the Campaign interface: Administration → Development → Custom resources → Profile. Add your field there, then publish and map it here." The mapping you save afterwards is stored in MarqIQ; your Campaign resource is untouched.
Map the tracking attributes
Below the form, UTM Field Validation lists MarqIQ’s 17 tracking fields — eight under First Touch UTM Fields and nine under Most Recent UTM Fields — against what your Campaign profile resource actually holds. A tenant that has never had these attributes made shows every row crossed. That is the expected first state, not a failed connection.
Create the attributes in Campaign under Administration → Development → Custom resources → Profile.
MarqIQ matches an attribute, ignoring case, in three ways: its name equals the field key shown on screen, such as `utm_source`; or its name is the `cust` form of that key with each underscored word capitalised, `custUtmSource`; or its label with spaces replaced by underscores equals the key. Name the attribute `custUtmSource` and MarqIQ finds it on its own.
The amber card on screen gives `custUtm_source` as its example, and that exact spelling matches none of the three. An attribute named that way is found only once you point MarqIQ at it with Map existing below.
Publish the resource in Campaign.
Click Refresh on UTM Field Validation in MarqIQ.
Attribute discovery reads your profile resource’s metadata live, so an attribute published a moment ago shows up on the next refresh.
Click Map existing on any row still marked Create in Campaign UI, then map here.
Type the Campaign attribute name into the box.
Use this where your attribute is named something MarqIQ’s matching does not recognise.
Click Save.
The mapping lives in MarqIQ. Your Campaign resource is not changed by it.
What connecting Adobe Campaign unlocks
Campaign profiles sync into the same record store every other tool writes to, so the analyses that read records run on them.
| Analysis | With Adobe Campaign |
|---|---|
| Source truth | Runs. It judges the field you report channels from, on your synced profiles. |
| Audience health | Runs. The blocklist and email opt-out flags come across on every profile. |
| Lead scoring | Runs where your profile resource holds a score attribute. |
| Funnel | Runs on what the profiles carry. |
| Form fills | Runs on fills MarqIQ’s own tracking script captured. Campaign’s form submissions are not read. |
| Field discipline | Not available. Campaign keeps no per-field change history MarqIQ can read. |
| Forecast accuracy | Not available. Campaign has no deals or opportunities. |
| Not available. Delivery statistics are not exposed by the Campaign Standard REST API. | |
| Automations | Not available. Workflows are not exposed by the Campaign Standard REST API. |
The by-tool half of the question. Whether an analysis then has something to say depends on what your own profiles hold.
The Audit says so rather than showing a zero
Delivery statistics, landing pages, form submissions, web visits and workflows are not read at all, because the Adobe Campaign Standard REST API does not expose them. Each of those sections in the Audit prints that reason. The pipeline sections are empty because Campaign has no deals, not because something failed.
Limits worth knowing before you rely on it
- Campaign publishes no deleted-profiles feed, so a profile deleted there stays in MarqIQ until a full resync. MarqIQ does not guess at deletions, and every completed sync says so in its log.
- Where your tenant’s profile resource offers no last-modified filter, every sync re-reads the whole profile list rather than only what changed. That is slower, not wrong — the writes are upserts — and the sync log names which of the two ran.
- Two Adobe hosts and nothing else: Campaign at mc.adobe.io and Adobe’s IMS endpoint at ims-na1.adobelogin.com, where the token is minted. MarqIQ refuses any other host for Campaign data, and a redirect off mc.adobe.io stops the call with "Adobe Campaign returned an unexpected redirect — refusing to follow" rather than being followed.
- One sync per tool runs at a time. A second start answers "Another sync is already running for this workspace — it will finish on its own."
If it did not work
The connect request is refused before any field is checked
Why: The workspace may not connect this tool. MarqIQ answers with the rule it broke: "Adobe Campaign is part of the Pro plan — this workspace is on Starter" for the plan floor, "Pro includes 2 tools besides Google Tag Manager, and this workspace has connected 2 (…). Disconnect one, or move up a plan." for the allowance, "Pro allows 1 tool from this category, and Marketo is already connected. Business and above allow more than one from the same category." for the category, and "This workspace is read-only. Renew the subscription to connect tools." where billing has lapsed.
Fix: Do what the message names: move up a plan, disconnect the tool it lists, or renew the subscription. Reconnecting Adobe Campaign when it is already connected is never refused, so an expired credential can always be replaced.
"Invalid tenant — use your Adobe Campaign tenant name (letters, numbers, dashes)."
Why: What you typed still carries a dot, a slash or another character after MarqIQ strips `https://` and `mc.adobe.io/`. A full URL with a path does this, and so does pasting the whole Campaign console address.
Fix: Type only the tenant — the "myorg" in mc.adobe.io/myorg. `mc.adobe.io/myorg` is accepted too. Nothing is sent to Adobe until this passes, so no credential is at fault here.
"API Key (the project's client id) is required"
Why: API Key was left empty. It is the OAuth Server-to-Server Client ID, not the client secret and not a token.
Fix: Copy the Client ID from your project at developer.adobe.com/console under Credentials → OAuth Server-to-Server, and paste it into API Key.
"Enter the client secret (lasting connection) — or, for a temporary connection, an access token."
Why: Neither Client Secret nor Access Token was filled in. MarqIQ needs one of the two, and prefers the secret.
Fix: Paste the secret into Client Secret. Where you hold only a token, click Only have an access token? and paste it into Access Token, knowing that connection stops within 24 hours.
"Adobe IMS refused to issue a token — check the client secret and that the project has the Campaign API added with the right scopes."
Why: Adobe would not mint a token at all. The secret is wrong or has been rotated, or the credential is missing one of the five scopes MarqIQ sends, or the project has no Adobe Campaign Standard API on it.
Fix: Generate a fresh client secret in the Developer Console, confirm the Adobe Campaign Standard API is on that project, and leave the credential’s five default scopes as Adobe set them. Then paste the new secret and click Update credentials.
"Invalid access token or API key."
Why: Adobe issued a token, and Campaign answered 401 to the one profile read MarqIQ makes to verify it. The X-Api-Key value is the usual culprit, or a pasted access token that has already expired.
Fix: Check API Key holds the Client ID from the same credential as the secret — a client id from one project with a secret from another gets exactly this. If you connected with a token, generate a fresh one and click Update credentials.
"Forbidden — check the API key's permissions in the Adobe Developer Console."
Why: Campaign answered 403. The credential authenticated, and its technical account is not entitled to this Campaign instance.
Fix: In Adobe Admin Console, add the credential’s technical account to a product profile on your Campaign instance. Read access is enough, because MarqIQ only ever reads. Then click Update credentials.
"Tenant not found — verify your tenant name."
Why: The tenant is well formed and Campaign answered 404 for it. It belongs to another organisation, or it is misspelt, or the credential is entitled to a different tenant.
Fix: Copy the tenant out of your own Campaign address at mc.adobe.io, paste it into Tenant, and connect again.
"Adobe Campaign error 500", or a message you do not recognise
Why: Campaign answered with a status MarqIQ has no wording of its own for — anything but 401, 403 and 404 — so it shows Campaign’s own message, or "Adobe Campaign error" and the status. A failed network call shows the message the request itself gave. MarqIQ retries a 429 or a 5xx three times before giving up, so this is what is left after those retries.
Fix: Check Adobe’s status for your region, wait a few minutes, and click Connect Adobe Campaign again. Nothing was saved, so there is nothing to undo.
The connection worked yesterday and today every sync fails
Why: You connected with an access token rather than the client secret, and the token has expired. MarqIQ cannot renew it, so Campaign refuses the run and the sync stops with "Adobe Campaign rejected the token (401) — reconnect the integration."
Fix: Open Adobe Campaign, paste the Developer Console client secret into Client Secret, and click Update credentials. The sync log tells you which of the two the connection is holding.
"Adobe Campaign connection is incomplete — reconnect the integration."
Why: The stored connection is missing its tenant, its API key, or both a client secret and an access token. A part-saved connection from an older form does this.
Fix: Fill in Tenant, API Key and Client Secret again, then click Update credentials.
Every row in UTM Field Validation is crossed
Why: Your Campaign profile resource has no attributes matching MarqIQ’s 17 tracking fields. On a tenant that has never had them made, this is the expected first state.
Fix: Create them in Campaign under Administration → Development → Custom resources → Profile, named `custUtmSource` and so on, publish the resource, then click Refresh. Where an attribute already exists under another name, click Map existing on its row instead. MarqIQ cannot create them for you.
A profile deleted in Campaign is still in MarqIQ
Why: Campaign publishes no deleted-profiles feed, and MarqIQ does not infer a deletion from a record’s absence.
Fix: Run a full resync to rebuild the store from what Campaign holds now.
"Another sync is already running for this workspace — it will finish on its own."
Why: The scheduled run holds this workspace. Only one sync per tool runs at a time, by design.
Fix: Nothing. Your profiles are being refreshed right now, which is why the message is shown in green rather than red.
Next steps
Related articles
Was this article helpful?