How to Integrate Bolt.new with Marketo

Marketo's API access is managed through the LaunchPoint service registry. Before you can make any API calls, a Marketo administrator must create an API-only user account and a corresponding LaunchPoint service that generates the client credentials. Step 1: Create an API-only user. In Marketo, go to Admin → Security → Users → Invite User. Enter an email address for the API user (can be a service account email), check 'API Only', and assign the appropriate role — at minimum the 'Read-Write Lead' and 'Read-Write Assets' permissions. Complete the invitation. Step 2: Create a LaunchPoint service. Go to Admin → Integration → LaunchPoint → New → New Service. Give the service a name (e.g., 'Bolt App Integration'), set the service type to 'Custom', and select the API-only user you just created. Save the service. Step 3: Get credentials. On the LaunchPoint services list, find your new service and click 'View Details'. You will see the Client ID and Client Secret. Copy both. Step 4: Find your REST API endpoint. Go to Admin → Integration → Web Services. Under the REST API section, you will see the Endpoint URL — it looks like https://[instance-id].mktorest.com/rest. Copy this URL. You will also need the Identity URL shown there, which is used for token requests. Store all four values in your Bolt project's .env.local file.

1// .env.local
2MARKETO_CLIENT_ID=your_client_id_here
3MARKETO_CLIENT_SECRET=your_client_secret_here
4MARKETO_REST_ENDPOINT=https://your-instance-id.mktorest.com/rest
5MARKETO_IDENTITY_URL=https://your-instance-id.mktorest.com/identity

The Marketo token request uses the Identity URL with GET parameters: grant_type=client_credentials, client_id, and client_secret. Despite being a GET request (not POST like most OAuth implementations), Marketo uses GET for token requests — this is a Marketo-specific quirk worth noting. The token response includes access_token and expires_in (seconds, typically 3600). Cache the token in server memory alongside its expiry timestamp. Check expiry before every API call and refresh if within 60 seconds of expiry. In a Next.js serverless environment, each function invocation may have its own memory, so the cache may not persist between requests — implement either a fast token cache (Redis or Upstash) for production or simply accept the small overhead of re-fetching tokens. The most fundamental Marketo operation is the lead upsert: creating a new lead if none exists with that email, or updating an existing lead's fields. Use POST /rest/v1/leads.json with action: 'createOrUpdate', lookupField: 'email', and an input array of lead objects. This single endpoint handles both creates and updates with deduplication on email address. The response includes a result array with each lead's id, status ('created', 'updated', or 'skipped'), and any errors.

1// lib/marketo.ts
2let tokenCache: { token: string; expiresAt: number } | null = null;
3
4export async function getMarketoToken(): Promise<string> {
5  if (tokenCache && Date.now() < tokenCache.expiresAt - 60_000) {
6    return tokenCache.token;
7  }
8
9  const identityUrl = process.env.MARKETO_IDENTITY_URL!;
10  const clientId = process.env.MARKETO_CLIENT_ID!;
11  const clientSecret = process.env.MARKETO_CLIENT_SECRET!;
12
13  // Note: Marketo token request uses GET (not POST) with query parameters
14  const response = await fetch(
15    `${identityUrl}/oauth/token?grant_type=client_credentials&client_id=${clientId}&client_secret=${clientSecret}`
16  );
17
18  if (!response.ok) throw new Error(`Marketo token request failed: ${response.status}`);
19
20  const data = await response.json();
21  if (data.error) throw new Error(`Marketo auth error: ${data.error_description}`);
22
23  tokenCache = {
24    token: data.access_token,
25    expiresAt: Date.now() + data.expires_in * 1000,
26  };
27  return tokenCache.token;
28}
29
30export async function marketoFetch(
31  path: string,
32  options: RequestInit = {}
33): Promise<Response> {
34  const token = await getMarketoToken();
35  const baseUrl = process.env.MARKETO_REST_ENDPOINT!;
36  return fetch(`${baseUrl}${path}`, {
37    ...options,
38    headers: {
39      Authorization: `Bearer ${token}`,
40      'Content-Type': 'application/json',
41      ...(options.headers ?? {}),
42    },
43  });
44}
45
46// app/api/marketo/leads/upsert/route.ts
47import { NextRequest, NextResponse } from 'next/server';
48import { marketoFetch } from '@/lib/marketo';
49
50interface MarketoLead {
51  email: string;
52  firstName?: string;
53  lastName?: string;
54  company?: string;
55  title?: string;
56  [key: string]: unknown;
57}
58
59export async function POST(request: NextRequest) {
60  const body = await request.json();
61  const leads: MarketoLead[] = Array.isArray(body) ? body : [body];
62
63  const response = await marketoFetch('/v1/leads.json', {
64    method: 'POST',
65    body: JSON.stringify({
66      action: 'createOrUpdate',
67      lookupField: 'email',
68      input: leads,
69    }),
70  });
71
72  if (!response.ok) {
73    return NextResponse.json({ error: `Marketo API error: ${response.status}` }, { status: response.status });
74  }
75
76  const data = await response.json();
77
78  if (!data.success) {
79    return NextResponse.json({ error: data.errors }, { status: 400 });
80  }
81
82  return NextResponse.json({
83    results: data.result,
84    requestId: data.requestId,
85  });
86}

Querying leads in Marketo requires understanding the filter type system. The GET /rest/v1/leads.json endpoint accepts filterType (the field to filter on) and filterValues (comma-separated values). The most common filter types are email (by email address), id (by Marketo lead ID), and leadPartitionId (all leads in a partition). Custom fields can also be used as filter types if they are indexed. The fields parameter controls which lead attributes are returned — always specify exactly the fields you need rather than returning all fields, as Marketo lead records can have hundreds of custom fields and returning all of them significantly increases response size and latency. For dashboard use cases that require sorting and paging across large lead databases, the bulk extract API is more appropriate than the filter API. However, bulk extract is asynchronous (you submit a job, wait for it to complete, then download the result file) and adds significant complexity. For dashboards showing the top N leads by score, using the filter API with the lead score filter type and a reasonable limit is simpler and works well for most use cases. Marketo's activity types API provides the historical record of what leads have done: email opens, web page visits, form fills, score changes. To get a lead's activity, first call /rest/v1/activities/leadchanges.json or /rest/v1/activities.json with the lead ID and a paging token. Activity queries require a paging token obtained from /rest/v1/activities/pagingtoken.json, which is a date-based starting point.

1// app/api/marketo/leads/query/route.ts
2import { NextRequest, NextResponse } from 'next/server';
3import { marketoFetch } from '@/lib/marketo';
4
5export async function GET(request: NextRequest) {
6  const { searchParams } = new URL(request.url);
7  const emails = searchParams.get('emails'); // comma-separated
8  const filterType = searchParams.get('filterType') ?? 'email';
9
10  if (!emails) {
11    return NextResponse.json({ error: 'emails query parameter is required' }, { status: 400 });
12  }
13
14  const fields = [
15    'id', 'email', 'firstName', 'lastName', 'company', 'title',
16    'leadScore', 'leadStatus', 'updatedAt', 'createdAt',
17  ].join(',');
18
19  const response = await marketoFetch(
20    `/v1/leads.json?filterType=${filterType}&filterValues=${encodeURIComponent(emails)}&fields=${fields}`
21  );
22
23  if (!response.ok) {
24    return NextResponse.json({ error: `Marketo API error: ${response.status}` }, { status: response.status });
25  }
26
27  const data = await response.json();
28
29  if (!data.success) {
30    return NextResponse.json({ error: data.errors }, { status: 400 });
31  }
32
33  return NextResponse.json({
34    leads: data.result,
35    total: data.result?.length ?? 0,
36    requestId: data.requestId,
37  });
38}