Marketo

Before touching Bubble, a Marketo administrator must complete three steps inside the Marketo admin panel. Skip any one of these and every API call will return a 401 or 403 error with no useful explanation. Step A — Create a permission role: In Marketo, go to Admin → Security → Roles → New Role. Name it 'Bubble API Role'. Under permissions, enable at minimum: Access API (required for all REST calls), Read-Write Lead (to create and update lead records), Read-Only Campaign (to query smart campaigns), and Read-Only Assets (to list emails and programs). Grant only the minimum permissions your Bubble app actually needs. Step B — Create an API-only user: Go to Admin → Security → Users & Roles → Invite User. Use a service account email address (e.g., bubble-integration@yourcompany.com) and check the 'API Only' checkbox — this prevents the account from being used for interactive login, which is the correct security practice for system integrations. Assign the Bubble API Role you just created. Step C — Register a LaunchPoint service: Go to Admin → Integration → LaunchPoint → New → New Service. Set Display Name to 'Bubble Integration', Service to 'Custom', and assign the API-Only user created in Step B. Click Create. Then click 'View Details' for the new service — you will see the Client ID and Client Secret. Copy both immediately and store them securely. While they can be viewed again later, having them on hand now saves you from navigating back through the admin panel.

Your Marketo instance URL is unique to your account — it is not a constant you can hardcode in the documentation, it must be your specific Munchkin URL. Before building any API Connector calls, save this URL as a Bubble App Constant so that if it ever needs to change, you update it in one place rather than editing every API call. In Bubble, go to Settings → App Constants → Add a constant. Set Name to 'MARKETO_BASE_URL' and Value to 'https://YOUR_MUNCHKIN_ID.mktorest.com' (replace YOUR_MUNCHKIN_ID with the three-segment ID you copied from Marketo, e.g., 'https://AAA-BBB-123.mktorest.com'). Do not include a trailing slash. Next, go to Plugins → Add plugins. Search for 'API Connector' and install the one by Bubble (it is the official plugin, published by Bubble itself). After installation it appears in your Plugins list as 'API Connector'. Also create a Bubble Data Type to store the OAuth token. Go to Data → Data Types → Create a new type → name it 'Marketo_Token'. Add two fields: 'token' (type Text) and 'expires_at' (type Date). This Data Type will hold exactly one row — the current valid access token and when it expires. You will check and refresh this row before every Marketo API call.

Marketo authentication requires two separate API Connector entries — one to fetch the access token, and one for the actual data calls. Click Plugins → API Connector → Add another API. Name this first entry 'Marketo Auth'. - Set Authentication to 'None' (you handle auth manually via query params). - Click 'Add call'. Name it 'Get Token'. - Method: GET - URL: https://YOUR_MUNCHKIN_ID.mktorest.com/identity/oauth/token - Under Params, add three parameters: - grant_type | Value: client_credentials | Private: unchecked (not sensitive) - client_id | Value: [your Client ID] | Private: CHECKED - client_secret | Value: [your Client Secret] | Private: CHECKED - Set 'Use as' to Action. - Click Initialize call. If credentials are correct, Marketo returns JSON containing 'access_token' and 'expires_in' (3600). Bubble detects these fields automatically. Now add a second API entry. Click 'Add another API'. Name it 'Marketo API'. - Under Shared Headers, add: Key: Authorization | Value: Bearer [dynamic_token] — leave [dynamic_token] as a placeholder with angle brackets, which tells Bubble this value will be supplied at runtime from the stored token. - Set Private: unchecked on this header (the Bearer token itself is a short-lived runtime value; the credentials that generate it are already Private in the Auth entry above). - Add individual calls as needed, such as a GET call named 'Get Lead by Email' pointing to /rest/v1/leads.json with query param filterType=email and filterValues=[email_address], and a POST call named 'Upsert Lead' pointing to /rest/v1/leads.json.

1// Marketo Auth — Get Token call configuration
2{
3  "method": "GET",
4  "url": "https://AAA-BBB-123.mktorest.com/identity/oauth/token",
5  "params": {
6    "grant_type": "client_credentials",
7    "client_id": "<private>",
8    "client_secret": "<private>"
9  }
10}
11
12// Expected successful response
13{
14  "access_token": "abcdef123456...",
15  "token_type": "bearer",
16  "expires_in": 3599,
17  "scope": "bubble-integration@yourcompany.com"
18}
19
20// Marketo API — Upsert Lead call configuration
21{
22  "method": "POST",
23  "url": "https://AAA-BBB-123.mktorest.com/rest/v1/leads.json",
24  "headers": {
25    "Authorization": "Bearer <dynamic_token>",
26    "Content-Type": "application/json"
27  },
28  "body": {
29    "action": "createOrUpdate",
30    "lookupField": "email",
31    "input": [
32      {
33        "email": "<lead_email>",
34        "firstName": "<first_name>",
35        "lastName": "<last_name>",
36        "company": "<company>"
37      }
38    ]
39  }
40}

Access tokens expire after 3,600 seconds (one hour). Marketo enterprise workflows may run infrequently enough that a stale token is the normal state when an operation begins. You must build a reusable Backend Workflow that checks whether the stored token is still valid and fetches a new one if not. In Bubble, go to Backend Workflows (found in the main editor sidebar below the regular Workflows section — only visible on paid plans). Click 'New API workflow' and name it 'Refresh_Marketo_Token'. The workflow should contain these steps: 1. Add a Condition step: check if Marketo_Token's expires_at < Current date/time + 60 seconds (the 60-second buffer catches edge cases where the token expires mid-workflow). 2. Under the 'yes' branch of that condition, add a step: Call the 'Marketo Auth → Get Token' API Connector action. 3. Next step: Create or modify a thing — if a Marketo_Token record already exists, update it; if not, create one. Set token = result of Get Token's access_token, and expires_at = Current date/time + 3500 seconds (a 100-second safety buffer before actual expiry). To prepend this workflow to any Marketo data call, in your main Workflows add the step 'Schedule API workflow → Refresh_Marketo_Token' at the beginning, wait for completion, then read the stored token from the Marketo_Token Data Type and pass it as the dynamic_token parameter to your Marketo API calls. Note: Backend Workflows require a paid Bubble plan (Starter at $32/mo or above). If you are on Bubble's Free plan, you cannot reliably manage this OAuth token flow server-side. Upgrade before attempting this integration — it is not optional for Marketo.

1// Logic flow for Refresh_Marketo_Token Backend Workflow
2//
3// Step 1: Condition
4//   IF: Marketo_Token's expires_at < (Current date/time + :60seconds)
5//     -- token is expired or about to expire
6//   THEN proceed to step 2
7//   ELSE: skip to end (current token still valid)
8//
9// Step 2: Call API — Marketo Auth > Get Token
10//   (no parameters needed, all auth params are Private in the connector)
11//
12// Step 3: Make changes to Marketo_Token (search for existing record)
13//   token  = result of step 2's access_token
14//   expires_at = Current date/time + :3500seconds
15//
16// In any data workflow that calls Marketo API:
17// Step 1: Schedule API workflow > Refresh_Marketo_Token (run synchronously)
18// Step 2: Get Marketo_Token's token (text field)
19// Step 3: Call Marketo API > [desired call] with dynamic_token = step 2's value

With authentication working, the primary integration workflow is syncing Bubble user records into Marketo as leads. This is the most common Marketo use case — keeping Marketo's lead database current with what is happening in your Bubble app. In Bubble's main Workflow editor, create a new workflow triggered by the event that should initiate a lead sync — typically 'A User signs up', 'A User's profile is updated', or a custom event like a user completing a key action. For each trigger, the workflow should: 1. Step 1: Schedule API workflow → Refresh_Marketo_Token (ensure the stored token is valid) 2. Step 2: Retrieve the current token from Marketo_Token Data Type (Do a search for Marketo_Token, first item's token field) 3. Step 3: Call Marketo API → Upsert Lead, passing: - dynamic_token = result of Step 2 - lead_email = Current User's email - first_name = Current User's first name - last_name = Current User's last name - company = Current User's company (if stored in Bubble) 4. Step 4: If the upsert returned a Marketo lead ID, store it in the User Data Type — this allows future calls to use the ID directly rather than looking up by email each time. For looking up an existing lead's data (including lead score), use the 'Get Lead by Email' call: GET /rest/v1/leads.json with filterType=email and filterValues=user@example.com. Marketo returns the lead's fields including leadScore, which you can display in a dashboard or use in Bubble Conditionals to gate features for highly-engaged users. For pushing a lead into a smart campaign, use POST /rest/v1/campaigns/[campaign_id]/trigger.json — but note this requires knowing the campaign ID in advance. Retrieve the list of available campaigns with GET /rest/v1/campaigns.json and store the relevant IDs as Bubble App Constants. RapidDev's team has built Marketo lead-sync pipelines in Bubble for enterprise clients — if your setup involves complex field mapping, multi-instance coordination, or high-volume sync requirements, a free scoping call is available at rapidevelopers.com/contact.

1// GET /rest/v1/leads.json — Look up lead by email
2// Request
3{
4  "method": "GET",
5  "url": "https://AAA-BBB-123.mktorest.com/rest/v1/leads.json",
6  "headers": {
7    "Authorization": "Bearer <dynamic_token>"
8  },
9  "params": {
10    "filterType": "email",
11    "filterValues": "<lead_email>",
12    "fields": "id,email,firstName,lastName,company,leadScore,createdAt,updatedAt"
13  }
14}
15
16// Successful response structure
17{
18  "requestId": "1234#abcdef",
19  "result": [
20    {
21      "id": 1001234,
22      "email": "user@example.com",
23      "firstName": "Jane",
24      "lastName": "Smith",
25      "company": "Acme Corp",
26      "leadScore": 75,
27      "createdAt": "2024-01-15T10:30:00Z",
28      "updatedAt": "2024-06-20T14:22:00Z"
29    }
30  ],
31  "success": true
32}

Two final production-readiness tasks: handling large result sets with pagination, and protecting the Marketo lead data you store in Bubble. Marketo's REST API returns paginated results using a nextPageToken field. For example, GET /rest/v1/leads.json returns a maximum of 300 records per call. If the response contains a nextPageToken field, there are more records to retrieve. In Bubble, implement pagination using a recursive Backend Workflow: - First call: GET /rest/v1/leads.json with your filter parameters → store results and check for nextPageToken in response. - If nextPageToken exists: Schedule the same Backend Workflow again, passing the token as an input parameter → Bubble appends it as a 'nextPageToken' query param on the next call. - This recursion continues until a call returns no nextPageToken. Be aware that recursive Backend Workflows in Bubble are subject to a 30-second per-workflow-run timeout. For very large Marketo instances with thousands of leads, consider pulling data in chunks over multiple scheduled runs rather than in a single recursive chain. For privacy: any Marketo lead data (email addresses, lead scores, company names) stored in Bubble Data Types must have appropriate Privacy Rules. Go to Data → Privacy → click your Marketo_Lead Data Type → Add a rule. The default rule should restrict all fields ('Find this in searches? No', 'View all fields? No') and then create an explicit rule for Admins or the specific roles that should see lead data. Without Privacy Rules, any authenticated Bubble user can query the Marketo_Lead table via the API. Also add a note to your Marketo_Lead Data Type description about the 50,000 calls/day limit — when your Bubble app and any existing Marketo integrations (Salesforce, Hubspot, native connectors) share this pool, a high-volume Bubble sync can impact critical business integrations. Check with your Marketo administrator about actual daily usage before building high-frequency sync workflows.

1// Recursive pagination logic (Backend Workflow pseudocode)
2//
3// Backend Workflow: 'Fetch_Marketo_Leads_Page'
4// Input: next_page_token (text, optional)
5//
6// Step 1: Call Marketo API > Get Leads
7//   - If next_page_token input is not empty, add param nextPageToken = input value
8//
9// Step 2: For each result in Step 1's result array:
10//   - Create or update a Marketo_Lead record
11//
12// Step 3: Condition — does Step 1's response contain a nextPageToken field?
13//   IF YES:
14//     - Schedule API workflow > Fetch_Marketo_Leads_Page
15//     - Pass next_page_token = Step 1's nextPageToken value
16//   IF NO:
17//     - End workflow (pagination complete)
18
19// Data → Privacy rule for Marketo_Lead Data Type:
20// Rule 1 (Everyone): Find this in searches = No, View all fields = No
21// Rule 2 (Admins/Operators): Find this in searches = Yes, View all fields = Yes