How to Integrate Retool with Marketo

Setting up Marketo API access requires administrator privileges. In Marketo, navigate to Admin → Security → Roles. Create a new role named 'Retool API' with the following permissions enabled under API Access: Read-Only Lead, Read-Write Lead (if you need write access), Read-Only Activity, Read-Only Assets, and Read-Only Campaign (add Read-Write Campaign for write operations). Next, go to Admin → Security → Users. Create a new user named 'Retool API User' with an API-Only designation checked. Assign the Retool API role. Note that API-Only users cannot log into the Marketo UI — they exist solely for API authentication. Now create the API credentials. Navigate to Admin → Integration → LaunchPoint. Click New → New Service. Fill in: - Display Name: Retool Integration - Service: Custom - Description: API service for Retool dashboards - API Only User: select the 'Retool API User' you created Click Create. In the LaunchPoint services list, click View Details next to 'Retool Integration'. You will see the Client ID and Client Secret — copy both values immediately. Your Munchkin ID is in Admin → Integration → Munchkin. It's a 9-character code like 'AAA-BBB-123'. Your Marketo API base URL is: https://AAA-BBB-123.mktorest.com (replace with your actual Munchkin ID). Store these in Retool Settings → Configuration Variables: - MARKETO_CLIENT_ID (your Client ID — not secret, but keep private) - MARKETO_CLIENT_SECRET (your Client Secret — mark as secret) - MARKETO_BASE_URL (https://YOUR_MUNCHKIN_ID.mktorest.com)

In Retool, navigate to the Resources tab and click Add Resource. Select REST API. Name: Marketo API Base URL: {{ retoolContext.configVars.MARKETO_BASE_URL }}/rest Note: The /rest path prefix is part of the base URL — all Marketo REST API paths start with /rest. Do not include it in individual query paths. Headers: - Key: Content-Type | Value: application/json Authentication: None (we will handle auth via a dynamic token in each query) Click Create Resource. Now create a JavaScript query named getMarketoToken that exchanges credentials for an access token. This query calls the identity endpoint (which uses a different path prefix than /rest): Create a second REST API resource named 'Marketo Identity' with base URL: {{ retoolContext.configVars.MARKETO_BASE_URL }}/identity Create a query named getAccessToken using the Marketo Identity resource: - Method: GET - Path: /oauth/token - Parameters: - grant_type: client_credentials - client_id: {{ retoolContext.configVars.MARKETO_CLIENT_ID }} - client_secret: {{ retoolContext.configVars.MARKETO_CLIENT_SECRET }} The response includes access_token and expires_in (3600 seconds). Store the token in a Retool state variable named marketoToken using an On Success event handler: marketoToken.setValue(data.access_token). Set this query to run on page load. Now all other Marketo API queries can use: Bearer {{ marketoToken.value }} in their Authorization header.

1// getAccessToken query response transformer
2// Verify the token response has the expected fields
3if (!data.access_token) {
4  throw new Error('Token response missing access_token: ' + JSON.stringify(data));
5}
6return {
7  access_token: data.access_token,
8  token_type: data.token_type,
9  expires_in: data.expires_in,
10  expires_at: new Date(Date.now() + data.expires_in * 1000).toISOString()
11};

Create a query named searchLeads. Set the resource to Marketo API, method to GET, and path to /leads.json. Required parameters for lead lookup by email: - filterType: email - filterValues: {{ textInput_email.value }} — comma-separated list of emails to look up - fields: id,firstName,lastName,email,company,leadScore,leadStatus,updatedAt,createdAt (comma-separated list of field API names) Headers for this query: - Authorization: Bearer {{ marketoToken.value }} The response includes a result array of lead objects matching the filter, and a success boolean. Always check success === true before processing results. If success is false, the errors array contains error codes and messages. Marketo's API returns field names using API field names (camelCase like firstName) rather than display names. The field names are configurable and may differ between Marketo instances — check Admin → Field Management for your account's field API names. For searches by name or other non-unique fields, use Marketo's Filter endpoint with a Smart List: POST /leads/filter.json with the filter criteria. This is more complex but supports rich filtering. Create a transformer that maps the lead objects to display-friendly rows, formatting dates and handling null values. Bind to a Table named table_leads.

1// Transformer for Marketo leads
2const leads = data.result || [];
3if (!data.success) {
4  const errMsg = (data.errors || []).map(e => e.message).join(', ');
5  throw new Error('Marketo API error: ' + errMsg);
6}
7return leads.map(lead => ({
8  id: lead.id,
9  first_name: lead.firstName || '',
10  last_name: lead.lastName || '',
11  full_name: `${lead.firstName || ''} ${lead.lastName || ''}`.trim(),
12  email: lead.email || '',
13  company: lead.company || '',
14  lead_score: lead.leadScore ?? 0,
15  lead_status: lead.leadStatus || '',
16  updated: lead.updatedAt ? new Date(lead.updatedAt).toLocaleDateString() : '',
17  created: lead.createdAt ? new Date(lead.createdAt).toLocaleDateString() : ''
18}));

Create a query named getPrograms. Set method to GET and path to /assets/v1/programs.json. Query parameters: - offset: {{ pagination.offset || 0 }} - maxReturn: 20 (max 200 per request) - filterType: programType (optional — filter to specific program types) - filterValues: email,nurture,engagement,event (comma-separated program types) - earliestUpdatedAt: {{ dateRange.start?.toISOString() || '' }} Headers: Authorization: Bearer {{ marketoToken.value }} Marketo's Assets API (path prefix /rest/assets/v1/) is separate from the Lead Database API (/rest/v1/). Both use the same Marketo API resource and the same access token, but the path structure differs — this is a common source of confusion. The response includes a result array of program objects with id, name, type, channel, status, workspace, tags, and description. For program membership details, create a getProgramMembers query: GET /v1/leads/programs/{{ table_programs.selectedRow?.data?.id }}/members.json - fields: id,firstName,lastName,email,membershipDate,progressionStatus,isExhausted,reachedSuccess - batchSize: 200 — pagination batch size - nextPageToken: {{ nextPageToken || '' }} — for cursor-based pagination Marketo uses a nextPageToken cursor for pagination on large result sets. Store the token from each response in a state variable to enable 'Load More' functionality.

1// Transformer for Marketo programs
2const programs = data.result || [];
3return programs.map(p => ({
4  id: p.id,
5  name: p.name || '(Unnamed)',
6  type: p.type || '',
7  channel: p.channel || '',
8  status: p.status || '',
9  workspace: p.workspace || 'Default',
10  created: p.createdAt ? new Date(p.createdAt).toLocaleDateString() : '',
11  updated: p.updatedAt ? new Date(p.updatedAt).toLocaleDateString() : '',
12  url: p.url || '',
13  tags: (p.tags || []).map(t => `${t.tagType}: ${t.tagValue}`).join(', ')
14}));

Marketo tokens expire after exactly 3,600 seconds (1 hour). Queries will start returning 601 errors ('Access token invalid') when the token expires. Build automatic token refresh handling. Create a JavaScript query named ensureValidToken: 1. Check when the token was last fetched (store the fetch time in a state variable tokenFetchedAt) 2. If current time - tokenFetchedAt > 55 minutes (3,300 seconds), call getAccessToken again 3. On success, update both marketoToken and tokenFetchedAt For bulk lead updates, Marketo provides a batch endpoint: POST /v1/leads.json with an action parameter: - action: createOrUpdate (upsert) | createOnly | updateOnly | createDuplicate - lookupField: email (the field to match existing leads on) - input: array of lead objects to create/update (max 300 per request) Build a bulk update form in Retool where users paste or upload a CSV of leads to update. Use a File Upload component for CSV input, parse it in a JavaScript query using Retool's built-in CSV parsing, then batch the updates in groups of 300. For complex Marketo implementations involving custom field management, program cloning automation, or multi-program reporting, RapidDev's team can help architect the full Retool solution with appropriate error handling and rate limit management.

1// Bulk lead update request body
2{
3  "action": "createOrUpdate",
4  "lookupField": "email",
5  "input": {{ JSON.stringify(
6    csvData.slice(batchStart, batchStart + 300).map(row => ({
7      firstName: row.firstName,
8      lastName: row.lastName,
9      email: row.email,
10      company: row.company,
11      leadScore: parseInt(row.leadScore) || 0
12    }))
13  ) }}
14}