How to Integrate Lovable with Pardot (Salesforce Marketing Cloud Account Engagement)

Log in to Salesforce Setup (click the gear icon → Setup). In the left sidebar, navigate to Apps → App Manager. Click New Connected App. Fill in the Connected App Name (e.g., 'Lovable Pardot Integration'), API Name (auto-filled), and Contact Email. Under OAuth Settings, check Enable OAuth Settings. In the Callback URL field, enter https://login.salesforce.com/services/oauth2/callback (a placeholder — you will use client credentials, not user-based OAuth). In Selected OAuth Scopes, add: 'Manage Pardot services (pardot_api)', 'Full access (full)', and 'Perform requests at any time (refresh_token, offline_access)'. Check Enable Client Credentials Flow. Save the Connected App. After saving, click Manage Consumer Details to see the Consumer Key (Client ID) and Consumer Secret (Client Secret). Also note: go to the Connected App's Manage page and click Edit Policies. Set OAuth Policies → IP Relaxation to 'Relax IP restrictions' if your Edge Function IPs are not whitelisted. Set Permitted Users to 'All users may self-authorize'. Finally, find your Pardot Business Unit ID in Pardot (from the Pardot account URL or in Pardot Settings → My Account — it looks like 0Uv000000xxxxxxxxx).

The Pardot Business Unit ID is required for every Pardot API v5 request. It is passed as a header named 'Pardot-Business-Unit-Id'. To find it, log into Pardot (via Salesforce App Launcher → Account Engagement). In Pardot, go to Settings (gear icon) → Account Settings → My Account. Look for the Account ID or Business Unit ID field — it is a long string beginning with '0Uv'. Alternatively, you can find it in the URL when logged into Pardot — the Pardot Account ID appears in the URL. If you cannot find it in the Pardot UI, you can also retrieve it via the Salesforce API by querying the Pardot Business Unit object, or ask your Salesforce admin. The Business Unit ID is specific to your Pardot instance and does not change. If your organization has multiple Pardot business units (enterprise feature), make sure you are using the correct one.

In your Lovable project, open the Cloud tab by clicking the plus (+) icon next to the preview. Navigate to Secrets and add four secrets: SALESFORCE_CLIENT_ID (the Consumer Key from your Connected App), SALESFORCE_CLIENT_SECRET (the Consumer Secret from your Connected App), PARDOT_BUSINESS_UNIT_ID (your Pardot Business Unit ID starting with 0Uv), and SALESFORCE_USERNAME plus SALESFORCE_PASSWORD if using password flow (for client credentials flow, you only need Client ID and Secret plus a username/password for the user the Connected App will act as). For the client credentials OAuth flow, also add SALESFORCE_INSTANCE_URL (your Salesforce instance URL like https://mycompany.my.salesforce.com). Click Save after each secret. Never put these in Lovable's chat or in code — the Salesforce Client Secret in particular grants access to your entire Salesforce org's data.

Build the Edge Function that handles the two-step authentication flow and proxies Pardot API calls. Step 1: obtain a Salesforce OAuth2 access token using the username-password grant (POST to https://login.salesforce.com/services/oauth2/token with grant_type=password, username, password, client_id, client_secret). Step 2: use the access token to call Pardot API v5 endpoints, including the Pardot-Business-Unit-Id header. Cache the Salesforce token in a Supabase table with its expiry time to avoid re-authenticating on every request. Accept POST requests with a JSON body specifying the HTTP method, the Pardot API endpoint path (like /api/prospect/version/5/do/query), and an optional request body.

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'
3
4const corsHeaders = {
5  'Access-Control-Allow-Origin': '*',
6  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
7}
8
9async function getSalesforceToken(clientId: string, clientSecret: string, username: string, password: string, supabase: any): Promise<{ token: string, instanceUrl: string }> {
10  const { data: cached } = await supabase
11    .from('pardot_token_cache')
12    .select('access_token, instance_url, expires_at')
13    .gt('expires_at', new Date(Date.now() + 300000).toISOString())
14    .single()
15
16  if (cached) return { token: cached.access_token, instanceUrl: cached.instance_url }
17
18  const params = new URLSearchParams({
19    grant_type: 'password',
20    client_id: clientId,
21    client_secret: clientSecret,
22    username,
23    password,
24  })
25
26  const resp = await fetch('https://login.salesforce.com/services/oauth2/token', {
27    method: 'POST',
28    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
29    body: params.toString(),
30  })
31
32  const data = await resp.json()
33  if (!data.access_token) throw new Error(`Salesforce auth failed: ${JSON.stringify(data)}`)
34
35  const expiresAt = new Date(Date.now() + 7200000).toISOString() // 2 hour cache
36  await supabase.from('pardot_token_cache').upsert({
37    id: 1,
38    access_token: data.access_token,
39    instance_url: data.instance_url,
40    expires_at: expiresAt,
41  }, { onConflict: 'id' })
42
43  return { token: data.access_token, instanceUrl: data.instance_url }
44}
45
46serve(async (req) => {
47  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
48
49  try {
50    const supabase = createClient(Deno.env.get('SUPABASE_URL')!, Deno.env.get('SUPABASE_SERVICE_ROLE_KEY')!)
51    const businessUnitId = Deno.env.get('PARDOT_BUSINESS_UNIT_ID')!
52
53    const { token, instanceUrl } = await getSalesforceToken(
54      Deno.env.get('SALESFORCE_CLIENT_ID')!,
55      Deno.env.get('SALESFORCE_CLIENT_SECRET')!,
56      Deno.env.get('SALESFORCE_USERNAME')!,
57      Deno.env.get('SALESFORCE_PASSWORD')!,
58      supabase,
59    )
60
61    const { method, endpoint, body: requestBody } = await req.json()
62
63    const pardotUrl = `${instanceUrl}/services/apexrest/pardot${endpoint}`
64    // Use the v5 API path format
65    const pardotV5Url = `${instanceUrl}${endpoint.startsWith('/') ? endpoint : '/' + endpoint}`
66
67    const response = await fetch(pardotV5Url, {
68      method: method || 'GET',
69      headers: {
70        'Authorization': `Bearer ${token}`,
71        'Pardot-Business-Unit-Id': businessUnitId,
72        'Content-Type': 'application/json',
73      },
74      body: requestBody ? JSON.stringify(requestBody) : undefined,
75    })
76
77    const data = await response.json()
78    return new Response(JSON.stringify(data),
79      { headers: { ...corsHeaders, 'Content-Type': 'application/json' } })
80  } catch (error) {
81    return new Response(JSON.stringify({ error: error.message }),
82      { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } })
83  }
84})

Build the Pardot prospect scoring dashboard in Lovable. Use the Edge Function to fetch prospects with their scores and grades. The Pardot API v5 uses RESTful endpoints — to query prospects, call GET /services/pardot/version/5/prospect/query with parameters for fields, filters, limit, and offset. The score field is a numeric value from Pardot's behavioral scoring. The grade field is a letter grade (A, B, C, D, E, or F) from Pardot's explicit profiling model. Display these in a dashboard with color-coded indicators: A and B grades in green, C in yellow, D and F in red. Include filters for score range, grade, assigned sales rep, and date range. Allow clicking into individual prospects to see their full activity history from Pardot.