Summary
From 30 September 2026, Salesforce requires the client secret of every installed package in Marketing Cloud to be rotated every 180 days. This also applies to the custom SFMC integration with Activation Studio. There is no downtime: your current secrets keep working until you activate the new ones.
Why this matters
Client secrets authenticate the API calls between Marketing Cloud and connected applications such as Activation Studio. Rotating them regularly limits the damage if a secret is ever exposed. Secrets that are not rotated in time will be flagged by Salesforce and may be disabled after the deadline, which would stop Activation Studio from communicating with your Marketing Cloud account. Salesforce describes the policy here: Marketing Cloud Client Secret Expiration.
Steps to take
Step 1 – In Marketing Cloud: Create the new secret
Go to Setup > Apps > Installed Packages > Activation Studio – SFSC integration > the API Integration
component > Staged Secret > Generate.
Salesforce describes the exact steps here: How to rotate client secrets.
Type a description you’ll recognise later (“Rotation September 2026”), then click Next. Copy the secret immediately. It’s shown once and can never be looked up again. Keep the new secrets somewhere safe for the next step; do not send them by email or chat. Nothing has changed for anyone yet; the old secret is still the active one.
Step 2 – In Salesforce: Update your new secret
Go to Setup › Quick Find: Named Credentials › External Credentials tab › Marketing Cloud – External Credential › under Principals, the row named Oauth › arrow › Edit. Paste the new value into Client Secret and click Save.
The field may look empty when you open it, that’s normal. Salesforce never shows a stored secret back to you. If Client ID is empty too, copy it from the same Marketing Cloud screen used in Step 1 and paste it back unchanged.
Step 3 – Check it works, before you commit
Open a Contact with the Activation Studio panels and refresh. If scores and interactions load, Salesforce is successfully using the new secret.
Both secrets are active right now, so a pass here genuinely proves the new one is good.
If it doesn’t load: stop here and contact us, don’t continue to Step 4.
Step 4 – Activate your staged secret
Back in Marketing Cloud on the API Integration component, click Activate on the staged secret. Delete your temporary copy of the secret.
Step 5 – Set a reminder for yourself
Set a calendar reminder about two weeks before the new one expires 180 days from when you generated it in Step 1.
Need help?
If you run into any issues updating your credentials, reach out to your main contact, which should be on of these:
Sander Hof – sander@harvestdigital.nl
Bram Honingh – bram.honingh@harvestdigital.nl
Nick Rottink – nick.rottink@harvestdigital.nl
