Connect Marketo

Create the API role in Marketo

Marketo grants API permissions through a role, not through the LaunchPoint service. Build the role first.

1. 1

   Sign in to Marketo as an admin.

2. 2

   Go to Admin → Security → Users & Roles → Roles.

3. 3

   Create a new role named MarqIQ.

4. 4

   Tick Read-Only Lead under Access API.

   This is the one permission nothing works without: the people themselves, every field your instance defines, and the field catalogue the analyses label their columns from.

5. 5

   Tick Read-Only Activity as well.

   Optional only in the sense that the connection survives without it. No Marketo sync ever finishes without it. It is Marketo’s activity log, and five things sit behind it — keeping the synced copy fresh after the first full walk, noticing people removed in Marketo, who last wrote a field and why, email results per person, and form fills.

   The removals lane runs on every sync. When Marketo refuses it the whole run stops before anything is committed, so the walk restarts from the same place for ever.

6. 6

   Tick the optional permissions for the parts of MarqIQ you want.

   • Read-Only Assets — your forms, smart campaigns, programs, landing pages, emails and templates by name. The Forms, Automations, Email and landing-page analyses read from here, and so does Template Studio’s destination picker.
   • Read-Write Lead — writing values back onto people: the one-click first-touch backfill, applying a change set you approved, and on Enterprise and Partner, or on a 7-day feature trial, writing standardised or enriched values. Not read-only.
   • Read-Write Schema Custom Field — the Create field button on the Marketo page, and the Schema write row in diagnostics. Not read-only.
   • Read-Only Schema Standard Field — a fallback route to your field list, reached only when Marketo’s two describe endpoints both come back empty, plus the Schema read row in diagnostics. Most instances never reach it. Read-Write Schema Standard Field satisfies it too, and grants more than MarqIQ uses.
   • Read-Write Assets — everything MarqIQ builds inside Marketo: hidden tracking fields on the forms you pick, the Source Tracking smart campaign and its folder, and Template Studio’s templates, drafts, folders, programs and images. Not read-only.
7. 7

   Open the Users tab.

8. 8

   Invite a new API-Only user.

   An API-Only user cannot sign in to the Marketo interface, which is what you want — this account exists for MarqIQ and nothing else.

9. 9

   Give that user the MarqIQ role.

Create the LaunchPoint Custom Service

1. 1

   Go to Admin → Integration → LaunchPoint.

2. 2

   Choose New → New Service.

3. 3

   Name the service MarqIQ.

4. 4

   Choose Custom as the service type.

5. 5

   Pick your API-Only user as the service’s user.

6. 6

   Click View Details beside the saved service.

7. 7

   Copy the client id and the client secret shown in that panel.

8. 8

   Go to Admin → Integration → Munchkin.

9. 9

   Copy the value shown as Munchkin Account ID.

   It looks like 123-ABC-456. Copy the ID itself, not a web address.

Connect it in MarqIQ

1. 1

   Open Connected Tools in MarqIQ and click the Marketo card.

   The page is headed Integrations, and Marketo sits under the Marketing Automation heading.

2. 2

   Find the REST API Credentials card.

3. 3

   Paste the client id into Client ID.

4. 4

   Paste the client secret into Client Secret.

5. 5

   Paste your Munchkin ID into Munchkin ID.

   MarqIQ trims stray spaces and trailing slashes, refuses anything that is not letters, numbers and hyphens, and builds the API address from what is left. Your sign-in host is never used.

6. 6

   Click Connect Marketo.

   MarqIQ asks your instance for a token before it saves anything. Nothing is stored unless Marketo issues one, so a wrong secret fails here rather than on the first sync.

   If Marketo is already connected the button reads Update credentials instead. Use it to replace a rotated secret without losing your field mappings.

7. 7

   Check the connection name.

   MarqIQ names the connection after the text you pasted — "Marketo (123-ABC-456)". Read it once to confirm it is the instance you meant.

Prove the role, before you trust the numbers

1. 1

   Click Run diagnostics on the Connection Diagnostics card.

2. 2

   Expect four green rows.

   • OAuth token — "Credentials accepted — token issued."
   • Lead read (describe) — "N lead fields visible." Compare N against what Admin → Field Management shows.
   • Schema read — "Can read lead field schema."
   • Schema write — "API role has schema write permission. Field creation should work." Diagnostics sends an empty list, so no field is made.
3. 3

   Read the closing line narrowly.

   Four green rows and "All checks passed — your Marketo connection is fully operational." cover the token, the lead read and the two schema permissions. They do not cover Read-Only Activity, so an all-green card sits quite happily beside a sync that fails on every run.

   The proof for the rest is a sync that finishes without an error and reports a person count in the region of what Marketo shows under Database, and analyses that name your real forms, campaigns and emails.

Connecting starts the first sync on its own. The chunk loop runs in your browser, so the status line says "keep this tab open". Close the tab and the run stops where it is; the next run, manual or scheduled, carries on from the saved cursor. Click Sync now to start one by hand.

What comes across

• People, with every field your instance defines — not a fixed list. MarqIQ asks Marketo what it has, splits the names into URL-sized groups, merges the answers per person, and saves the result as the field catalogue the analyses label their columns from.
• Everyone, not only the recently active. Marketo has no "list all people" call, so the first sync walks the person-id space in batches of 300 until roughly ten thousand ids in a row come back empty. It runs in slices, and a 48,000-person instance takes a dozen or more of them.
• Person changes since the last sync, from the lead-change feed, watching every discovered field rather than a chosen few.
• People removed in Marketo, so a record deleted there stops counting here — and only the ids Marketo itself names.
• Field-change activity for the people an analysis is judging, 750 days back: the field, the old value, the new value, and what caused it — a form, a named smart campaign, a list import, a person editing the record, the API, or the CRM sync.
• Which person fields Marketo itself marks read-only, so they are dropped from the field-discipline checks and kept out of the list Field Mapping offers you.
• Email activity — sent, delivered, bounced, unsubscribed, opened, clicked — counted as people rather than events, with Marketo’s own Is Bot Activity flag used to keep security-scanner opens and clicks out of your open and click rates.
• Form fills, your approved forms, web-page visits, landing pages, programs, and smart campaigns with their state, type, dates and Marketo’s own "invalid" flag.
• Design Studio and Marketing Activities structure — folders, programs, channels, templates, emails, landing pages and each form’s fields — when you use Template Studio.

What MarqIQ writes back

Everything MarqIQ creates in Marketo, it creates because you pressed something. Nothing is made on a schedule; the scheduled job only reads and syncs.

• Person field values, for the one-click first-touch backfill — where the first-touch field is empty and its most-recent counterpart holds something. At most 2,000 people per run; run it again for the rest.
• Person field values, when you apply a change set you approved: empty fields only, each one re-checked against the live record immediately before the write and skipped if someone got there first. At most 500 changes in one set.
• Person field values, when you write standardised or enriched values back, on Enterprise and Partner or a 7-day feature trial. This one can replace a value. At most 500 people a run, with no approval step and no undo.
• One custom person field, when you press Create field — a 255-character text field named after the standard key, for example utm_source_most_recent. MarqIQ never removes a Marketo field.
• Hidden tracking fields on the forms you pick. The field is added, flipped to hidden, and the form’s draft is then approved.
• One smart campaign, "MarqIQ - Source Tracking (Copy Most Recent to First Touch)", with the full configuration recipe written into its description. Nothing activates it.
• A folder named "MarqIQ" to hold that campaign, because Marketo refuses campaigns created at the workspace root. If Marketo refuses folder creation everywhere, MarqIQ places the campaign in a folder or program you already have rather than failing.
• Template Studio: a template in Design Studio, approved straight afterwards because Marketo only offers approved templates when building an asset; then an email or landing page built from it, left as a DRAFT.

What MarqIQ will not do in Marketo

• It never deletes a person and never deletes a Marketo field.
• From its screens it deletes one thing only, inside Template Studio and on an asset it made itself: the unused modules it strips out of a draft email while building it.
• It never sends an email, never activates a smart campaign, and never publishes an email or landing page. The Source Tracking campaign arrives inactive.
• It cannot link a finding into Marketo. MarqIQ holds the API address and cannot work out your sign-in address, so records are listed in full here instead. A landing page or smart campaign shows a link only when Marketo itself returns one.

What connecting Marketo unlocks

Marketo feeds eight of the nine analyses that report findings: Source truth, Field discipline, Audience health, Lead scoring, Funnel, Form fills, Email and Automations.

• Source Tracking Implementation — the packaged flow that creates the UTM fields, adds them as hidden fields on your forms, and creates the tracking campaign. Marketo and HubSpot are the only two tools that support all three steps.
• Add Fields to Forms — pick existing fields, choose visible or hidden, and place them on as many forms as you like.
• Template Studio — email templates in Marketo’s own markup, on Pro and above. Creating the email or landing page in Marketo from that template is on Enterprise and Partner, or on a 7-day feature trial.
• Audit Report — field completeness, email, form and page activity, and automations, as a shareable report.
• Lead Field Mapping on the Marketo page — MarqIQ scores every Marketo field against each tracking field and shows the top suggestions, badged Best match, Good match or Possible. Use Create field to make a missing one, or Map existing to point at a field you already keep.

The limits, stated

• Marketo’s own retention sets the ceiling. Records of removed people are pruned after about 14 days, which is why that lane runs on every sync; field-change history is kept about 25 months, so MarqIQ looks back 750 days.
• Reads are capped and every cap is disclosed: the audit reads at most 3,600 activities and 2,000 assets of each type, email results stop at 45,000 activities with subject lines read for 80 emails, and the Automations analysis reads the first 4,000 smart campaigns.
• The two form-writing screens read your form list one page deep — 200 forms, no paging — so a larger instance will not see all of its forms there, even though the Forms analysis pages through 2,000.
• The incremental sync names the fields it wants changes for, and that list is trimmed to fit the request. On an instance with very many fields, an edit to a field past that point produces no change record, and stays invisible until a full re-read reaches that person.
• The first sync walks the id space blind. If MarqIQ holds no Marketo records yet and the first 350,000 ids come back empty it gives up and falls back to the change feed, so an instance whose person ids start above that is never fully backfilled.
• Marketo’s daily API quota is shared with everything else that calls your instance, and a full backfill is thousands of calls.