Marketo access token - GET/ POST

[Babu_Chikati]

Hi,

I noticed Marketo has GET/POST endpoint to get access token, but both endpoints  accepting query parameters only, Is there any reason?

<URL>/identity/oauth/token?client_id=<Client Id>&client_secret=<Client Secret>&grant_type=client_credentials

 clientid and secret are exposed to internet when pass them as query parameters, is there any better approach to prevent from exposing clientid and secret?

Thanks,

Babu

[SanfordWhiteman]

---

 clientid and secret are exposed to internet when pass them as query parameters

---

In what way are they “exposed”?

Anyone who can intercept the TLS connection between your back end server and Marketo (if that’s truly what your company is concerned about) can read the entire HTTP transaction. No difference whether credentials are in the URL or the body.

[Babu_Chikati]

Thank you, Sanford!

"exposed" I mean client id and client secret is visible in plain text in an URL.

That is true I agree with you,  but plain text in an URL is more vulnerable than hacking a network protocol. 

Could be more stringent than just having plain text in an URL.

May be something like  on the lines of not supporting access token in query parameter to call any of Web APIs from June 2025.

Thanks,

Babu

[SanfordWhiteman · Accepted solution]

It's not more secure in any way!

The path and query of an https:// URL are never passed in plain text. Ever. They are as secure as the body of a https:// request. You would need to hack the TLS connection in both cases, which is vanishingly unlikely for a server-to-server connection.

I recommend you fire up a network monitor and watch the TLS connection. You'll never see query parameters in plain text, because that's not how the protocol works. Everything is encrypted except for the hostname (and even *that* will be encrypted if the client and server support ESNI or ECH).

[Babu_Chikati]

Thank you, Sanford.

Thanks,

Babu