Skip to main content
Connect your Marketo instance to allGood so Mary can access your Programs, Smart Lists, and lead information. This setup requires administrator access to Marketo and takes about 15 minutes. Once connected, Mary will be able to retrieve program details, analyze campaign performance, and update token values — all without leaving your conversation.

​
Before you begin

You’ll need:
  • Administrator access to your Marketo instance
  • Permission to create API users in Marketo’s Admin panel
  • allGood account with integration permissions
If you don’t have Marketo admin access, forward this guide to your Marketing Ops team. They’ll need the allGood IP addresses listed in Step 5 below.

​
What happens during setup

You’ll create a dedicated API user in Marketo that allGood uses to access your data. This user has no login password — it exists only for API connections. You control exactly what data this user can access by setting its role permissions. The setup process generates four credentials: a Client ID, Client Secret, REST Endpoint URL, and Identity URL. You’ll copy these into allGood to complete the connection. Data access: Once connected, Mary can read Marketo Programs, Smart Campaigns, Smart Lists, and lead records. Mary cannot delete Programs, send emails, or modify Smart Campaign logic. If your organization’s security policy requires IP whitelisting, you’ll add allGood’s IP addresses in Step 5.

​
Steps

1

Create an API role

  1. Log into Marketo with administrator access
  2. Go to Admin → Users & Roles → Roles
  3. Click New Role

Roles page showing New Role button

  1. Name the role allGood API Role
  2. Check the Access API checkbox under API Access
  3. Click Create

New Role form with API Access enabled

This role grants API access without UI login permissions. The specific permissions are controlled at the LaunchPoint service level, which you’ll configure in Step 3.
2

Create an API-only user

  1. Go to Admin → Users & Roles → Users
  2. Click Invite New User

Users page showing Invite New User button

  1. Enter an email address for the API user (example: api-allgood@yourcompany.com)
  2. Enter a first and last name (example: “allGood API User”)
  3. Under User Role, select the allGood API Role you created in Step 1
  4. Check API Only — this prevents the account from logging into Marketo’s UI
  5. Click Send Invite

New API User form with role assignment

Marketo will send an email to the address you specified, but no action is needed. API-only users don’t require email confirmation.
3

Create a LaunchPoint service

  1. Go to Admin → LaunchPoint
  2. Click New → New Service

LaunchPoint page showing New Service option

  1. Configure the service:
    • Display Name: allGood Integration
    • Service: Select Custom
    • Description (optional): API access for allGood Mary
    • API User: Select the user you created in Step 2
  2. Click Create

New LaunchPoint form with configuration

LaunchPoint generates the Client ID and Client Secret you’ll need in Step 4. Don’t close this window yet.
4

Copy your API credentials

  1. On the LaunchPoint services list, find the allGood Integration service you just created
  2. Click View Details

LaunchPoint service list showing View Details link

  1. Copy the Client ID — it looks like a1b2c3d4-e5f6-7890-abcd-ef1234567890
  2. Click Show next to Client Secret, then copy the secret value
  3. Store both values temporarily in a secure location (you’ll paste them into allGood in Step 6)

Client ID and Secret display screen

The Client Secret is shown only once. If you close this window without copying it, you’ll need to delete the service and create a new one.
5

Get your REST API endpoint URLs

  1. Go to Admin → Web Services
  2. Scroll to the REST API section
  3. Copy the Endpoint URL — it looks like https://123-ABC-456.mktorest.com/rest
  4. Copy the Identity URL — it looks like https://123-ABC-456.mktorest.com/identity

Web Services page showing REST API endpoints

If your Marketo instance has IP restrictions enabled:Look for the IP Restrictions section on the same Web Services page. If it shows “Enabled,” you must whitelist allGood’s IP addresses before the integration will work:
  • 52.25.122.65
  • 52.26.241.77
Add both addresses to the Allowed IP Addresses list. If you’re not sure whether IP restrictions are enabled, check with your Marketo administrator or IT team before proceeding.

IP Restrictions section with allGood IPs added

6

Connect the integration in allGood

  1. Log into allGood and go to Settings → Integrations
  2. Click Add Integration and select Marketo

allGood integrations page

  1. Paste the four credentials you collected:
    • Client ID (from Step 4)
    • Client Secret (from Step 4)
    • Endpoint URL (from Step 5)
    • Identity URL (from Step 5)

Marketo integration form with credential fields

  1. Click Save
allGood tests the connection immediately. If the credentials are valid and IP restrictions (if enabled) are configured correctly, the integration status changes to Active within a few seconds.

allGood integrations page with Marketo marked as Active

​
You’re done — verify the connection

Once the integration shows Active on your Integrations page, Mary can access your Marketo data. Test the connection by asking Mary a simple question like:
  • “Show me all Marketo Programs created this month”
  • “What Marketo Smart Lists exist in the Email Nurture workspace?”
  • “Get the token values for [Program Name]”
If Mary retrieves results, the integration is working. If Mary returns an error or says she cannot access Marketo, proceed to the troubleshooting steps below.

​
Troubleshooting

This means allGood could not authenticate with your Marketo instance. Check:
  1. Client ID and Client Secret — Copy them again from the LaunchPoint service details and re-paste them into allGood. Make sure there are no extra spaces before or after the values.
  2. Endpoint and Identity URLs — Verify you copied the full URLs from the REST API section, not the SOAP API section.
  3. LaunchPoint service configuration — Confirm the API User assigned to the service is the API-only user you created, not a different user.
If all credentials are correct and the error persists, your Marketo instance may have IP restrictions enabled. Proceed to the IP whitelisting step below.
If your Marketo instance requires IP whitelisting:
  1. Go to Admin → Web Services in Marketo
  2. Scroll to IP Restrictions
  3. If restrictions are enabled, add both allGood IP addresses to the allowed list:
    • 52.25.122.65
    • 52.26.241.77
  4. Click Save
  5. Return to allGood and click Reconnect on the Marketo integration
Changes to IP restrictions take effect immediately. Test the connection again by asking Mary to retrieve a simple list of Programs.
The API user’s role may not have permission to access the resource Mary is trying to read. Common causes:
  • Workspace restrictions — If your Marketo instance uses Workspaces, the API user must be assigned to the Workspace containing the data Mary is trying to access. Check the user’s Workspace assignments in Admin → Users & Roles → Users.
  • Role permissions — The allGood API Role must have Access API checked. Verify this in Admin → Users & Roles → Roles.
After updating permissions, no reconnection is needed — changes take effect immediately.
Contact allGood support and include:
  • The exact error message Mary returned
  • A screenshot of your LaunchPoint service configuration (with Client Secret hidden)
  • Whether IP restrictions are enabled in your Marketo instance
  • The Marketo instance ID (visible in your Endpoint URL — the part before .mktorest.com)
Support will verify the configuration and work with your Marketo admin if needed.

​
Frequently asked questions

The allGood integration can read Marketo Programs, Smart Campaigns, Smart Lists, and lead records. It cannot delete Programs, send emails, modify Smart Campaign logic, or change lead data. The API-only user you create controls exactly what data is accessible through its role permissions and Workspace assignments.
A dedicated API-only user ensures the integration operates independently of any individual employee’s account. If someone leaves the company or has their password changed, the integration continues working. API-only users cannot log into Marketo’s UI, reducing security risk.
allGood’s integration connects from these IP addresses:
  • 52.25.122.65
  • 52.26.241.77
If your Marketo instance has IP restrictions enabled, you’ll need to whitelist both addresses in Admin → Web Services → IP Restrictions.
Yes. If your Marketo instance uses Workspaces, assign the API user only to the Workspaces where allGood needs access. The user can only read data from assigned Workspaces. Configure Workspace access in Admin → Users & Roles → Users.
To disconnect allGood from Marketo:
  1. In allGood: Go to Settings → Integrations → Marketo, and click Disconnect
  2. In Marketo: Go to Admin → LaunchPoint, find the allGood Integration service, and click Delete
Deleting the LaunchPoint service immediately invalidates the API credentials.
Yes. Every request Mary makes to Marketo counts toward your daily API call limit (typically 10,000-100,000 calls per day depending on your Marketo subscription). Mary’s queries are optimized to use minimal API calls, but high-frequency usage may approach your limit. Monitor API usage in Marketo at Admin → Web Services → API Call Usage.
  • Managing Mary’s access to Marketo data
  • Updating Marketo Program tokens with Mary
  • Using Mary to analyze Marketo campaign performance