A connection stopped working or asks me to reconnect
A connection that keeps lapsing is almost always a credential with a clock on it, or a credential that belongs to a person rather than to an integration account. This article names the causes in the order they are likely and tells you how to stop each one coming back. If a sync is running but never finishing, read A sync is stuck, or never finishes instead.
Before you start
Reconnecting is always allowed, even on a workspace that has used up its tool allowance. Pasting a fresh credential onto a tool you already have never counts as connecting a new one.
Tip
Open Attribution & Journeys and find the Connected Data Sources card first. A run that failed shows your tool's own message in red under the tool's name, and that message tells you which cause below you have.
Three credentials expire on their own
Most connectors take a credential that lasts, so a connection that drops on one of them means something changed in your tool. Three take one that lapses on its own, and those are the ones people reconnect over and over.
| Tool | What lapses | How long |
|---|---|---|
| Salesforce | The access token — it is a session id | Your Connected App's session-timeout policy |
| Pardot (MCAE) | The Salesforce access token it authenticates with | The same policy |
| Google Tag Manager | The Google OAuth access token | About an hour |
HubSpot, Pipedrive and Mailchimp use long-lived tokens or API keys. Zoho CRM, Microsoft Dynamics, Marketo, Marketing Cloud and the two Adobe tools mint their own access tokens from credentials that do not expire.
The causes, most likely first
Salesforce says "Salesforce token expired — please reconnect", or several Salesforce screens go odd at once
Why: The access token is a session id and has lapsed. Two screens are less honest about it than the rest: the audit's deals section blames Opportunity access instead of the token, and campaign names quietly fall back to raw 701… ids with no message at all.
Fix: Get a fresh access token from the OAuth flow or from `sf org display --json`, paste it into Access Token on the Salesforce page, and click Update credentials. Do this before you go hunting for a permissions problem.
You filled in the Salesforce or Pardot Refresh Token field and it made no difference
Why: MarqIQ redeems a refresh token against a client id and secret held in its own server configuration, not against the Connected App you created. Salesforce ties a refresh token to the client id that issued it, so a token minted by your own app or by the CLI is unlikely to be accepted.
Fix: Treat the Salesforce and Pardot access tokens as something you re-paste by hand. Leaving the refresh-token field blank changes nothing else.
A Google Tag Manager deploy fails an hour or two after you connected
Why: The Google access token lasts about an hour. MarqIQ renews it from the refresh token where renewal is switched on for the workspace; if no refresh token was stored, or renewal is off, the connection stops until you paste a fresh token.
Fix: Connect Google Tag Manager shortly before you deploy, not days ahead. Generate a fresh token beginning ya29. at developers.google.com/oauthplayground and paste it in again.
Pipedrive says "Pipedrive rejected the API token — reconnect the integration"
Why: The token belongs to a person, not to an app. It carries their permissions and their record visibility, and it dies with their Pipedrive seat. It also ends if they regenerate it.
Fix: Generate a token at app.pipedrive.com/settings/api for an account that can see the whole CRM and that nobody is going to deactivate — a dedicated integration user — then reconnect with it. Read the message carefully: it is also what MarqIQ says when the token is fine but its owner cannot read your field definitions, pipelines or stages.
HubSpot says "HubSpot token invalid or expired — reconnect the integration" after somebody edited the private app
Why: HubSpot issues a new token whenever you change an app's scopes. The token MarqIQ holds is the old one.
Fix: Copy the new token from the private app at app.hubspot.com/l/private-apps, paste it into Access Token on the HubSpot page, and click Update token. Your field mappings are kept.
Dynamics 365 stops with "Dynamics 365 rejected the token (401) — reconnect the integration", and nothing warned you
Why: A pasted Dynamics access token is accepted so you can look around, but MarqIQ cannot renew it and does not stop using it when it lapses — it keeps sending it until Dynamics refuses. The connection still shows as connected until then.
Fix: Reconnect with the Azure app registration — tenant id, client id and secret, from portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade — instead of a pasted token. That credential mints its own access tokens and does not need replacing.
Zoho says "Zoho refused to renew the access token" or "Zoho rejected the token — reconnect the integration with the CRM read scopes"
Why: Either the Self Client refresh token was revoked in Zoho, or the OAuth client no longer carries the CRM read scopes.
Fix: Create the Self Client credentials again at api-console.zoho.com with the CRM read scopes, check you have picked the right data-centre region on the connect form, and reconnect.
The message says the connection is incomplete rather than rejected
Why: One of the stored values is missing. Marketing Cloud needs a client id, a client secret and a subdomain. Pardot needs an access token, a business unit ID and an API base. Adobe Campaign needs a tenant, an API key, and either a client secret or an access token. A partial save reads as incomplete rather than as a bad credential.
Fix: Open that tool's page and fill in every field on the connect form, then submit it again. Nothing is carried over from a partial attempt.
Everything broke at once after your Salesforce sandbox was refreshed
Why: A sandbox refresh rebuilds the org. The Connected App, the integration user and the custom fields you created are all gone, so the saved token points at something that no longer exists.
Fix: Rebuild the Connected App and the integration user in the refreshed sandbox, create your `utm___c` fields again, then reconnect with Sandbox chosen under Environment* and re-map the fields.
How to stop it happening again
- Connect as a dedicated integration user, not as a person. A credential tied to somebody's seat dies when they change role or leave, and that is the commonest cause of a connection that drops without warning.
- On Dynamics, Zoho, Marketo, Marketing Cloud and the two Adobe tools, use the credential that mints its own tokens rather than pasting an access token. The connect form for each one accepts both, and only one of them lasts.
- Name the credential after MarqIQ where your tool allows it. HubSpot attributes every change to the app that made it, so a private app called MarqIQ shows as MarqIQ in a record's history.
- On Salesforce and Google Tag Manager, plan for re-pasting. Neither renews itself in practice, so build that into whoever owns the connection.
What happens to your analyses while a connection is down
Your already-synced records stay exactly where they are, so reports built on them keep working and keep showing the date they were last refreshed. What stops is anything that needs a live call: creating fields, writing to forms, reading change history, and the sync itself.
Most screens quote your tool's own refusal back to you rather than showing a zero, so a blank section with a message is a permissions or credential problem and a blank section with no message is genuinely empty. Salesforce has two exceptions worth knowing: campaign names fall back to raw ids in silence, and the field-history-tracking lookup reads a refusal as "nothing is tracked".
Reconnecting without losing your setup
Open Connected Tools and click the tool's card.
The page is headed Integrations.
Paste the new credential into the same fields you used before.
Click Update token or Update credentials.
The button carries that label instead of Connect whenever the tool is already connected.
Click Sync now.
The run resumes from the saved cursor rather than starting the whole load again.
Leave the tab open until the status line says it has finished.
Note
You do not need to disconnect first, and you should not. Your field mappings and your synced records survive a reconnect untouched.
Next steps
Related articles
Was this article helpful?