Connect Salesforce
You run the OAuth flow yourself in Salesforce, then paste the resulting access token and your instance URL into MarqIQ. MarqIQ creates nothing in your org: every field it needs is one you make yourself in Setup. If you want to know what you are granting before you start, read How connecting a tool works.
Before you start
Permissions required
MarqIQ holds one Salesforce user's session. What it reads, and anything it writes, is exactly what that user could do by hand, and Salesforce records that user as Last Modified By. A dedicated integration user is the usual choice, and it needs Salesforce's API Enabled permission before anything below applies.
Take care
The access token is a session id, not a long-lived key. It lapses on your Connected App's session-timeout policy, and you will need to paste a fresh one. Read the reconnect article before you plan around this.
Connect with one click
If your connect page shows a Connect with Salesforce button, use it. You sign in to Salesforce, approve MarqIQ, and are sent straight back connected. The token MarqIQ receives this way renews itself, so nothing lapses and nothing has to be pasted again. The button appears when your MarqIQ deployment holds its own Salesforce Connected App; when it does not, the page says so and the steps below apply.
Choose Production or Sandbox.
A sandbox signs in at test.salesforce.com; production at login.salesforce.com. Pick the one the org lives in.
Click Connect with Salesforce.
Sign in and click Allow.
Everything MarqIQ reads is what the signed-in account can read, so a dedicated integration account with read access to the objects below is the tidy choice. The consent screen names two scopes: Manage user data via APIs and Perform requests at any time.
Sign in as a Salesforce System Administrator the first time
Since September 2025 Salesforce refuses, by default, any app that is not yet installed in your org unless the signing-in user holds the Approve Uninstalled Connected Apps permission — which only Salesforce’s System Administrator profile has out of the box. If another user tries first, Salesforce answers with an OAuth error and MarqIQ tells you this is why. To let an integration account connect instead, an admin opens Setup → Connected Apps OAuth Usage, finds MarqIQ and clicks Install; from then on any permitted user can sign in.
Why there is no username-and-password option
Marketo’s older sync typed a Salesforce username, password and security token into Marketo. Salesforce is retiring that method: from Winter ’27 the SOAP login needs an extra permission, on 20 February 2027 the OAuth username-password flow stops, and on 1 June 2027 the SOAP login is switched off. MarqIQ does not offer a path that breaks within the year; the sign-in button is the same OAuth flow HubSpot uses.
Or paste a token from your own Connected App
In Salesforce, go to Setup → Apps → App Manager.
These paths are inside your own org, so MarqIQ cannot link you straight there the way it links you to HubSpot or the OAuth Playground.
Click New Connected App.
Tick Enable OAuth Settings.
Move exactly two entries across in Selected OAuth Scopes: Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access).
Every call MarqIQ makes is a REST call against your org's data API, which is the first scope. The second lets Salesforce issue a refresh token. Leave the rest where they are — Full access (full) grants far more than MarqIQ uses, and the web, Chatter and identity scopes are not read by anything.
The `api` scope carries both reading and writing. What holds MarqIQ to reading is the connecting user's object and field permissions, below.
Complete the OAuth flow and copy the access token.
If you have the Salesforce CLI, run `sf org display --json` against the org and copy `accessToken` instead.
Copy your instance URL.
It is your My Domain host — the host in your address bar while you are inside Salesforce, for example
https://myorg.my.salesforce.com. For a sandbox, use that sandbox's own host.Give the connecting user read access to the objects you want.
A refused object is stepped over with a note in the sync log when Salesforce names the object it is refusing. A bare 403 stops the whole run instead, under a message about the token.
| Read on | What it turns on |
|---|---|
| Contact | The connection check itself, and your contacts. MarqIQ verifies your token by describing the Contact object. |
| Lead | Leads, and the fallback the connect check uses when the Contact describe fails for some reason other than a refusal. |
| Account | Companies, with industry, annual revenue, employee count and billing country. |
| Opportunity | Deals: the pipeline, the stage-and-amount breakdown in the audit, the forecast lab and opportunity field intelligence. |
| OpportunityContactRole | Which people sit on which opportunity — the join that ties a person's attribution to a deal. |
| OpportunityHistory | Stage, amount, close-date and forecast-category snapshots at every change. Salesforce keeps this with no tracking setup at all. |
| OpportunityStage | Your active stages in sales-process order, each with its configured probability. |
| Campaign | Campaign names. Without it a campaign id such as 701… stays a raw id wherever a campaign is shown. |
| Organization | Your org's name and country on the connection card. |
| FlowDefinitionView | The Automations analysis: your flows and Process Builder processes. |
| LeadHistory, ContactHistory, OpportunityFieldHistory | Field discipline: who or what last changed a field, and whether a first-touch value was overwritten. |
Only the `api` OAuth scope is strictly required; `refresh_token, offline_access` makes the connection last. Everything else here is one user's object permissions.
Paste it into MarqIQ
Open Connected Tools in MarqIQ and click the Salesforce card.
The page is headed Integrations, and Salesforce sits under the CRM heading. Its own page is headed Salesforce CRM.
Choose Production or Sandbox under Environment.
This does not decide where your data is read from — every call goes to the instance URL you paste. It picks the login host used if a token refresh is ever attempted, and labels the connection " · Sandbox" so nobody mistakes it for production.
Paste the token into Access Token.
Paste the host into Instance URL.
It must be https. Before your token goes anywhere, MarqIQ resolves the host and refuses plain http, a URL carrying a username or password, or a host that resolves to an internal address. It will not follow a redirect off that host.
Leave Refresh Token blank unless you have read the note below.
Click Connect Salesforce.
MarqIQ verifies the token against the Contact describe, falling back to Lead, and reads your org's name and country back so the card shows which org it is. If the tool is already connected the button reads Update credentials instead.
Leave the tab open while the first sync runs.
The chunk loop runs in your browser, so the status line says "keep this tab open". Close the tab and the run stops where it is. The next sync carries on from the saved cursor.
Open Integration Audit Report and choose Salesforce.
Click the Field Intelligence tab.
Check for four groups: Leads, Contacts, Opportunities and Accounts.
A group that says nothing is synced means either that the object holds no records or that the sync stepped over it for lack of access. The sync log says which.
About the refresh token
MarqIQ redeems a refresh token against a client id and secret held in its own server configuration, not against the Connected App you created. Salesforce ties a refresh token to the client id that issued it, so a token minted by your own app or by the CLI is unlikely to be accepted, and MarqIQ falls back to asking you to reconnect. Leaving the field blank changes nothing else.
What comes across
- Leads, Contacts, Accounts and Opportunities — every field Salesforce describes for your user, apart from address, location, base64 and encrypted-string types. Fields are fetched in batches, so an object carrying 900 fields still syncs whole.
- Which people sit on which opportunity, from the opportunity contact roles.
- Opportunity snapshots of stage, amount, close date and forecast category, and your active stages with their configured probabilities.
- Which fields have Field History Tracking switched on, and the history rows for the records sampled.
- Campaign names, for the campaign ids found in your data.
- Salesforce's own removal log for each object, so records deleted there are marked gone in MarqIQ's copy rather than left looking live.
- A record count per object, so drift between Salesforce and MarqIQ's copy can be reported.
Where the samples and caps are
Field history is a sample rather than a census: up to 600 people and 600 deals per run, and Salesforce itself keeps tracked history for only 18 to 24 months and for at most 20 fields per object. Campaign names resolve at most 500 unnamed ids per pass and are cached for a day. Record-count drift is reported, never repaired.
Five things a HubSpot connection does and a Salesforce one does not
Read this before you plan an implementation around it. Five things a HubSpot connection does are not available on a Salesforce connection today.
- MarqIQ never creates a field, object, flow, campaign or report in Salesforce. Asking it to create a custom field is refused by name: "Use Salesforce Setup to create custom fields. Map them here once created." Even its own attribution field, MarqIQ_Last_Update__c, is left for you to create.
- There is no guided source-tracking setup. Source tracking setup supports HubSpot and Marketo only, so the workflow that copies most recent into first touch has to be built in Salesforce by hand.
- There is no automated write onto your forms. If your forms are backed by Salesforce, capture the source with the tracking script and hidden fields instead.
- There is no empty-fields-only rule anywhere in the Salesforce write path — no first-touch backfill and no change sets. What writes exist replace the value that is there.
- Core Salesforce only. Email sends, landing pages, form analytics and web visits live in Marketing Cloud or Account Engagement. Connect that tool to analyse them.
Create the seventeen tracking fields yourself
In Salesforce, go to Setup → Object Manager → Contact → Fields & Relationships → New.
Create a Text field for each UTM field, for example `utm_source__c`.
Salesforce needs the Metadata API to create a custom field programmatically, so MarqIQ leaves this to you and says so on the Salesforce page.
Return to the Salesforce page in MarqIQ and click Map existing against each row under UTM Field Validation.
What MarqIQ writes, when you ask it to
- Field values on Lead and Contact records only, one update per record. Accounts and Opportunities are never written.
- Enrichment push writes Industry, Company and Phone on Leads, and Phone on Contacts, because a contact’s industry and company belong to its account. It skips any change whose value is empty, so that route never blanks a field.
- Normalisation apply writes First name, Last name, Job title, Phone, Country and State or region on Leads and Contacts, plus Company, Industry and Website on Leads only. On a Contact, country and state are MailingCountry and MailingState. A phone held in Mobile phone is written there. It has no empty-value guard: normalising a placeholder such as "N/A" writes an empty value over it, and the screen says so.
- MarqIQ_Last_Update__c, carrying a timestamp and which feature changed which fields, added to the same update. It is written only when your org has already created that field. MarqIQ does not create it for you.
- Every write is started by you from a screen and is capped at 500 records a run. Nothing is written on a schedule — the scheduled sync only reads.
If it did not work
The connection is refused with "Access token is invalid or expired" although the token is minutes old
Why: MarqIQ verifies the token by describing the Contact object. A user without read access to Contact produces the same message as a token that has lapsed.
Fix: Give the connecting user read access to Contact in Salesforce, then connect again. If that user genuinely cannot see Contacts, give them read on Lead — the check falls back to the Lead describe.
Several screens go odd at once: deals blame Opportunity access, campaign names turn into 701… ids
Why: The access token has lapsed. Two screens are less honest about it than the rest — the audit's deals section blames Opportunity access instead of the token, and campaign names fall back to raw ids with no message.
Fix: Paste a fresh access token into Access Token and click Update credentials before you go hunting for a permissions problem.
The whole sync stops with a message about the token, before Leads and Contacts are reached
Why: Salesforce answered a bare 403 on the Accounts walk, which runs first. A refusal that names the object is stepped over with a note. One that does not is treated as a token problem.
Fix: Give the connecting user read access to Account, or re-paste the token. Then click Sync now — progress is saved, so the run resumes rather than restarting.
Field discipline says nothing is tracked, and you know tracking is on
Why: The permission behind the Field History Tracking lookup was refused, and MarqIQ reads that refusal as "nothing is tracked" rather than as a permissions problem.
Fix: Give the connecting user View Setup and Configuration, which covers the FieldDefinition read, then run the analysis again.
A field is populated on some records from the same run and blank on others
Why: One batch of extra fields failed mid-sync and was stepped over for that page only. There is no note on screen when this happens.
Fix: Click Sync now and let the run complete. A second pass over the same records fills the gap.
The connection card is headed by the bare instance host, with no org name or country
Why: Only the Organization read was refused. Nothing else about the connection is wrong.
Fix: Give the connecting user read on Organization if you want the org name shown, or leave it — the connection works either way.
Next steps
Related articles
Was this article helpful?