What to send your CRM or IT admin
You create the credential MarqIQ needs inside your own tool, and in most tools that takes an admin. This page gives you one message per tool to send them: what to create, where it lives, which permissions to tick, and what stops working without each one. To understand what you are granting before you ask, read How connecting a tool works first.
Before you start
Note
Eight connect forms carry a card headed What MarqIQ needs from that tool, and this page is that card in a form you can paste into an email: HubSpot, Salesforce, Pipedrive, Microsoft Dynamics, Zoho CRM, Marketo, Adobe Campaign and Google Tag Manager. For Pardot (MCAE), Mailchimp, Salesforce Marketing Cloud and Adobe Journey Optimizer, open that tool’s own page under Connected Tools and read its article here.
Permissions required
You do not need admin rights to ask. You do need to know which account, portal, org or instance you want connected, because the credential is made inside that one and MarqIQ shows you what it attached to afterwards.
Do these three things before you write the message
Name the exact account you want connected.
The HubSpot portal, the Salesforce org, the Dynamics environment, the Marketo instance. A credential made in the wrong one connects perfectly and shows you somebody else’s data.
Decide whether you want MarqIQ to write anything.
Reading gets you the analyses, the audit and the reports. Writing is what fills an empty field, adds hidden fields to a form, creates the tracking properties or builds a workflow. Every tool below can be connected read-only.
Ask for a dedicated integration user rather than your own account.
A credential made from a person carries that person’s permissions and record visibility, and stops working when they lose their seat or change their password.
Why a dedicated integration user
- A Pipedrive API token belongs to one person. It carries their permission set and their record visibility, Pipedrive attributes whatever it does to them, and it dies with their seat.
- Salesforce records the connected user as Last Modified By on every record MarqIQ touches, and that user needs Salesforce’s API Enabled permission before any call reaches your org.
- Marketo needs an API-Only user on a role, plus a LaunchPoint Custom Service bound to that user. LaunchPoint on its own hands you credentials that sign in perfectly and can read nothing.
- A HubSpot private app is named, and HubSpot attributes every change to the app that made it. Name it MarqIQ and its writes read as MarqIQ in a record’s history rather than as an unnamed integration.
- Microsoft Dynamics takes two people: somebody with Azure rights registers the app and makes the secret, and a Power Platform admin then gives that app a security role in the environment.
Which permissions allow writing
These are the ones to leave off if your admin wants MarqIQ read-only. Everything else in each request below is a read.
| Tool | The permissions that allow writing |
|---|---|
| HubSpot | crm.objects.contacts.write, crm.schemas.contacts.write, forms, automation, content, files |
| Salesforce | Edit on Lead and Contact, plus field-level Edit on the fields MarqIQ writes. Accounts and Opportunities are never written. |
| Marketo | Read-Write Lead, Read-Write Schema Custom Field, Read-Write Assets |
| Zoho CRM | ZohoCRM.modules.ALL also permits creating, editing and deleting records. MarqIQ issues no create, update or delete against any Zoho record, but the grant allows it. |
| Pipedrive | There is no read-only version of the token. It can do whatever its owner can, and MarqIQ exercises one write with it — adding custom fields when you ask. |
| Microsoft Dynamics | None. MarqIQ issues no write of any kind against Dynamics. The token is not read-only, so choose the security role as though it could write. |
| Adobe Campaign | None. MarqIQ only ever issues GETs, so a read-only Campaign product profile is enough. |
| Google Tag Manager | tagmanager.edit.containers. It does not allow publishing — Google keeps that behind a separate scope MarqIQ never asks for and never sends. |
HubSpot
Please create a HubSpot private app called "MarqIQ" and send me its access token.
Settings -> Integrations -> Private Apps -> Create a private app
https://app.hubspot.com/l/private-apps
Required scope. Nothing connects without it:
crm.objects.contacts.read
Please also tick, if you are happy with each:
crm.objects.deals.read deals. Without it no deal syncs and every
pipeline figure is empty.
crm.objects.companies.read companies, and which company each deal is on.
crm.schemas.deals.read our custom deal properties.
crm.schemas.companies.read our custom company properties.
crm.objects.owners.read owner names instead of ids, and each owner's
email, kept in our workspace only to match
the person signed in to their owner.
business-intelligence sessions, sources, landing-page views, and the
submission count per form.
email-events sends, opens, clicks and bounces per person.
Write access, only if we want MarqIQ to change things:
crm.objects.contacts.write fill an empty field, apply a change we approved.
crm.schemas.contacts.write create the UTM tracking properties.
forms form names, and hidden tracking fields on the
forms we pick.
automation read our workflows, and build the source-tracking
one. It arrives switched off for us to review.
content marketing emails and landing pages. Drafts only.
files upload template images into the File Manager.
The token has to be created in the portal whose data we want.Take care
crm.schemas.deals.read sounds as though it covers deals and does not. Without crm.objects.deals.read no deal syncs at all, and this is the scope people most often miss.
Note
If your portal cannot create private apps, a Service Key works instead — Settings then Integrations then Service Keys, at app.hubspot.com/l/service-keys A private app is preferred because its name appears in change history.
A token missing an optional scope does not break the connection. Most screens quote HubSpot’s own refusal back to you instead of showing a zero.
Salesforce
Please create a Connected App for MarqIQ, and send me an access token and our
instance URL.
Setup -> Apps -> App Manager -> New Connected App -> Enable OAuth Settings
https://help.salesforce.com/s/articleView?id=sf.connected_app_create.htm
Or, from the Salesforce CLI: sf org display --json, then copy accessToken.
OAuth scope:
api ("Manage user data via APIs")
The connecting user needs API Enabled, and Read on:
Contact and Lead the people. The connect check reads Contact first.
Account companies. Walked first, so a refusal here can stop
the whole run before people are reached.
Opportunity deals, the audit breakdown and the forecast.
OpportunityContactRole which people sit on which deal.
OpportunityHistory stage, amount, close-date and forecast-category
snapshots. No tracking setup needed.
OpportunityStage our active stages and their probabilities.
Campaign campaign names instead of ids such as 701...
Organization our org name on the connection card.
FlowDefinitionView flows and processes, for the Automations analysis
("View Setup and Configuration").
FieldDefinition which fields have Field History Tracking switched on.
LeadHistory, ContactHistory, OpportunityFieldHistory
field discipline: what changed a field, and when.
Please also consider "Replicate Data" and "View All Data". They let MarqIQ read
Salesforce's own deletion log, so a record deleted in Salesforce stops counting
in MarqIQ. Without them those records linger in MarqIQ's copy.
Field-Level Security: Read on every field we want synced.
Write-back, only if we want it: Edit on Lead and Contact, plus field-level Edit
on the fields MarqIQ writes.
Please use a dedicated integration user. Salesforce records it as Last Modified
By on everything MarqIQ touches.
Instance URL: the host in the address bar while we are inside Salesforce, for
example https://myorg.my.salesforce.com. For a sandbox, that sandbox host.Take care
The Salesforce token is a session id, not a long-lived key, and it expires on your Connected App’s session-timeout policy. MarqIQ redeems a refresh token against client credentials held in its own server configuration rather than against the Connected App you asked for, so a refresh token minted by that app or by the CLI is unlikely to be accepted. Plan on re-pasting a token.
Note
A refused Contact describe is reported as "Access token is invalid or expired", so a perfectly good token held by a user without Contact access looks exactly like an expired one. Ask for Contact read before you go hunting for a token problem.
Salesforce keeps field history only for fields an admin has switched tracking on for, up to 20 per object. Ask which fields are tracked — an untracked field is named as untestable rather than reported as clean.
Pipedrive
Please send me the personal API token of a Pipedrive user who can see the whole
CRM, together with our company domain.
Profile avatar -> Personal preferences -> API -> copy the personal API token
https://app.pipedrive.com/settings/api
Company domain: the "mycompany" from mycompany.pipedrive.com. The subdomain on
its own, not the full address.
Pipedrive has no scope picker, so the token is that person. Their account needs
to be able to see:
people and organizations the contacts and companies we report on.
deals every pipeline figure, win rate and forecast.
activities calls, meetings and tasks.
leads the Leads Inbox.
field definitions, pipelines and stages
read on every run, before a single record is
stored. A refusal here ends the run.
Adding custom fields is an admin right, and only needed if we want MarqIQ to
create the UTM fields rather than map fields we already have.
The token dies with that person's Pipedrive seat, so please use an account that
is not going anywhere.Take care
A token that is restricted rather than refused is the quiet problem: MarqIQ syncs only the records its owner can see, and the sync still reports success, because the number it prints is how many people were stored. Ask for an account that sees the whole CRM.
Microsoft Dynamics
Please register an Azure app for MarqIQ and send me four values.
Azure portal -> App registrations -> the app
https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
Directory (tenant) ID Overview
Application (client) ID Overview
Client secret Certificates & secrets -> New client secret.
Copy the Value, not the Secret ID. It is shown once.
Power Platform admin centre -> Environments -> our environment
https://admin.powerplatform.microsoft.com/environments
Environment URL the https root only, for example
https://myorg.crm.dynamics.com
Then, in that environment:
Settings -> Users + permissions -> Application users -> New app user
Pick the app, and give it a security role with Read at ORGANIZATION depth on:
Account, Contact, Lead, Opportunity
plus read access to table metadata (EntityDefinitions).
Optional, so a record deleted in Dynamics stops counting in MarqIQ:
Change tracking switched on per table
Power Apps -> Tables -> the table -> Settings
Optional, for field discipline:
Auditing switched on for the environment, the table and each column
View Audit History on the role (Miscellaneous privileges)
Please tell me the date the client secret expires.Take care
Nothing in MarqIQ watches the client secret’s expiry, and the connection card still reads Connected on the day it dies. What changes is that the next sync stops with "Azure AD refused to issue a token for this app registration". Put the expiry date in your own calendar.
Take care
Depth matters as much as the tick. An application user with User-level read owns no records, so MarqIQ syncs nothing and reports success rather than an error.
Note
Owner names, currency names and parent-company names arrive as labels on the records themselves, so no privilege for Dynamics’ own User or Currency tables is listed. If owners come back blank on a tightly scoped role, that is the first thing to test.
Zoho CRM
Please create a Self Client in Zoho's API Console, signed in as a user of the
Zoho organisation whose data we want, and send me four things.
https://api-console.zoho.com -> Add Client -> Self Client
Client ID the Client Secret tab. Zoho ids look like 1000.XXXXXXXX
Client Secret the same tab
Grant code Generate Code, with the two scopes below. It expires within
minutes and is spent on first use, so send it straight away.
Data centre which region our CRM is on: crm.zoho.com, crm.zoho.eu,
crm.zoho.in, and so on.
Scopes:
ZohoCRM.modules.ALL required. Leads, Contacts, Accounts and Deals.
ZohoCRM.settings.ALL the field list on each module, read before any record
is read. Without it nothing syncs at all.
If you already hold a refresh token for this Self Client, send that instead of
a grant code.Take care
ZohoCRM.modules.ALL also permits creating, editing and deleting records. MarqIQ issues no create, update or delete against any Zoho record, but the grant allows it — say so when your admin asks.
Note
The data centre fixes both the address MarqIQ reads your CRM from and the address it mints tokens at, and the two are not always the same family: Canada’s CRM API sits on zohoapis.ca while its token service sits on zohocloud.ca. Choose the wrong region and the credentials are refused at connect rather than pointed at an empty account.
Note
Rotating the client secret in the API Console breaks the connection at the next token renewal — within the hour — rather than the next time somebody reconnects.
Marketo
Please create an API-Only user and a LaunchPoint Custom Service for MarqIQ, and
send me three values.
Admin -> Security -> Users & Roles -> Roles: a role carrying the permissions
below.
Admin -> Security -> Users & Roles -> Users: an API-Only user on that role.
Admin -> Integration -> LaunchPoint -> New Service -> Custom, bound to that
user -> View Details
Client ID
Client Secret
Admin -> Integration -> Munchkin
Munchkin Account ID, for example 123-ABC-456. The ID, not a web address.
Role permissions:
Read-Only Lead required. People, and every field our instance defines.
Read-Only Activity no sync ever finishes without it. Please grant it with
the required one above.
Read-Only Assets forms, smart campaigns, programs, landing pages, emails
and templates, by name.
Write-back, only if we want it:
Read-Write Lead fill an empty field, apply an approved change.
On Enterprise or Partner, or a 7-day feature
trial, write standardised or enriched values.
Read-Write Schema Custom Field create the UTM fields.
Read-Write Assets hidden fields on forms, and the source
tracking campaign.Take care
Connecting does not test the role. MarqIQ checks only that Marketo issues a token, so a role with the wrong permissions connects cleanly and then reads nothing. Click Run diagnostics on the Marketo page — when a check fails it names the exact checkbox.
Note
There is no link here to open Marketo’s admin screens, because they live on your instance’s own sign-in host, which MarqIQ never learns — it holds the API address only. Adobe documents Custom Services at experienceleague.adobe.com/en/docs/marketo-developer/marketo/rest/custom-services
Adobe Campaign
Please create an OAuth Server-to-Server credential for MarqIQ in the Adobe
Developer Console, and send me three things.
https://developer.adobe.com/console -> our project -> Credentials ->
OAuth Server-to-Server
Client ID the Console also labels this API Key
Client Secret revealed when it is generated
Tenant the "myorg" in mc.adobe.io/myorg
The project needs the Adobe Campaign Standard API added to it, and the
credential's technical account needs entitlement to our Campaign instance. A
read-only Campaign product profile is enough: MarqIQ only ever issues GETs.
Please send the client secret rather than a generated access token. Adobe
tokens live about a day; with the secret, MarqIQ mints its own and scheduled
syncs carry on without anyone visiting the page.
There is no JWT step. Adobe retired that credential type, and MarqIQ has never
accepted one.Note
Adobe issues a server-to-server credential carrying five scopes and MarqIQ sends all five unchanged. Trimming the set is how a connection fails rather than how it is narrowed, because Adobe refuses the whole token when the credential is missing any one of them.
Google Tag Manager
Please generate a Google OAuth access token for our Tag Manager container, and
send it with the two ids.
Google Cloud Console -> enable the Tag Manager API on the project -> create
OAuth 2.0 credentials (a Client ID and Secret).
Then https://developers.google.com/oauthplayground
gear icon -> tick "Use your own OAuth credentials"
paste the Client ID and Secret
authorise these two scopes:
https://www.googleapis.com/auth/tagmanager.readonly
https://www.googleapis.com/auth/tagmanager.edit.containers
"Exchange authorization code for tokens"
copy the Access token (it begins ya29.) and the Refresh token
https://tagmanager.google.com/
GTM Account ID Admin -> Account Settings. The numeric one.
Container ID either the GTM-XXXXXX code, or the numeric one under
Admin -> Container Settings.
Please send the ACCESS TOKEN, not the Client ID or the Client Secret, and send
it shortly before we deploy: it runs out after about an hour.
MarqIQ never publishes the container. Somebody on our side reviews the tag in
Tag Manager and publishes it.Take care
A value containing .apps.googleusercontent.com is the Client ID, and one beginning GOCSPX- is the Client Secret. MarqIQ names which one you pasted, because it is the commonest mistake here.
Note
A Custom HTML tag belongs to a web container. A server-side, AMP, iOS or Android container connects happily, and the refusal arrives from Google at deploy time rather than from the connect screen.
Everything MarqIQ does at connect time is a read, so a view-only token connects and fails only when you press Deploy. Ask for tagmanager.edit.containers if you want the one-click deploy.
What your admin will ask you back
| Their question | Your answer |
|---|---|
| Does it write to our production records? | Only where you grant a write permission, and only from a screen somebody clicked. Nothing is written to a record on a schedule. The scheduled sync only reads, and for Adobe Journey Optimizer it creates the export it reads from. |
| Can it delete anything? | None of your records: MarqIQ never deletes a contact, company or deal. From its screens it deletes only things it made itself. Those are the HubSpot workflow you ask it to rebuild while that one is still switched off and unchanged, the unused blocks of a Marketo draft email it is building, and a test file it writes when you validate a HubSpot template. |
| Can it send email or publish a page? | It sends no email and publishes no page. In HubSpot it creates draft emails and landing pages. A template it pushes is live at once in HubSpot and Pardot. Pushing it again replaces it, so an email or page built on it can change. The one workflow it builds arrives switched off. In Tag Manager it never publishes the container. |
| How much can one run change? | A change set holds at most 500 changes. One run of writing standardised or enriched values covers at most 500 records, and one run of the first-touch fill up to 2,000. |
| Can we undo it? | An applied change set can be undone for 30 days. Nothing else MarqIQ writes can be undone from MarqIQ. |
| Who approved a change? | A change set records who proposed it and who approved it, and only a workspace admin can approve one. The other writes have no approval step: whoever holds the permission runs them. An AI assistant can propose a change set and can never approve or apply one. |
| Where is the credential kept? | Encrypted, and sent in a request header rather than in a web address. |
| Which environment does it read? | Whatever the address you give points at. For a Salesforce sandbox, paste that sandbox’s own instance URL. |
For the full set of standing promises, send them What MarqIQ will never do to your data. It is written to be forwarded.
If it did not work
Your admin sent a value and MarqIQ says it is the wrong kind of credential
Why: The Client ID and the Client Secret are what generate a token; they are not the token. MarqIQ checks the shape of what you paste before it contacts the tool, and names which one you gave it.
Fix: Go back to whoever made it and ask for the value from the exchange step — for Google Tag Manager, the access token that begins ya29.; for Dynamics, the client secret Value rather than the Secret ID.
HubSpot connects and every pipeline figure is empty
Why: The token carries crm.schemas.deals.read but not crm.objects.deals.read. The schema scope sounds as though it covers deals and does not.
Fix: Ask for crm.objects.deals.read to be added to the private app, then paste the token again. Nothing else needs redoing.
Zoho CRM connects and then syncs nothing
Why: The connection test reads a single lead, which ZohoCRM.modules.ALL allows on its own. MarqIQ reads the field list on each module before it reads a record, and that needs ZohoCRM.settings.ALL.
Fix: Ask for a new grant code with both scopes, and reconnect. This is the first thing to check when a connection that looked fine syncs nothing.
Marketo connects cleanly and reads nothing
Why: The LaunchPoint service exists but the API-Only user’s role is missing Read-Only Lead or Read-Only Activity. Connecting checks only that Marketo issues a token.
Fix: Click Run diagnostics on the Marketo page. It names the exact checkbox to add under Admin then Security then Users & Roles then Roles.
Dynamics reports a successful sync with no records in it
Why: The application user’s security role reads at User depth. An application user owns no records, so a User-level read returns an empty list with no error at all.
Fix: Ask the Power Platform admin to set the role to Read at Organization depth on Account, Contact, Lead and Opportunity, then run the sync again.
Pipedrive numbers look complete and are not
Why: The token belongs to a user whose record visibility is restricted. Restricted is not refused, so the sync succeeds and reports how many records it stored.
Fix: Check the name on the Pipedrive connection card against who you meant, and ask for a token from an account that sees the whole CRM.
Everything worked and several screens went odd at once
Why: A token expired. The Salesforce session id and the Google Tag Manager access token both run out, and a Dynamics client secret has an expiry date nothing in MarqIQ watches.
Fix: Re-paste the credential before you go hunting for a permissions problem. Read A connection stopped working or asks me to reconnect for what each tool says when this happens.
Next steps
Related articles
Was this article helpful?