How to create a dedicated, read-only OAuth integration for synchronising Content Builder creative assets and folders with Medialake.

What to expect

This guide creates a dedicated OAuth integration for Salesforce Marketing Cloud Engagement Content Builder. It allows Medialake to retrieve creative assets and folders from your organisation's authorised Business Unit.

>Access boundary. The integration is read-only. It does not provide access to contacts, subscribers, sends, journeys, or other Salesforce CRM data.

Before you begin

The person completing this setup must have these Marketing Cloud permissions:

Administration → General → Access
Administration → Installed Package → Administer

They must also have access to the Business Unit containing the required Content Builder assets.

Step 1: Open Marketing Cloud Setup

Sign in to Salesforce Marketing Cloud Engagement.
If necessary, switch to the Business Unit containing the Content Builder assets.
Hover over your username in the top-right corner.
Select Setup.
In Quick Find, search for packages.
Select Installed Packages under Apps.

>If an option is missing: If Setup or Installed Packages is unavailable, contact your Marketing Cloud administrator to obtain the permissions listed above.

Step 2: Create the package

Select New.
Enter:

- Name:Medialake Content Builder

- Description:Read-only integration for synchronising Content Builder creative assets with Medialake

Save the package.
Under Components, select Add Component.
Select API Integration.
Select Web App as the integration type.

>Important: Use the Web App integration type. Do not select Server-to-Server and do not create a Salesforce Lightning Connected App.

Step 3: Configure the OAuth application

Add this exact redirect URL:

https://oauth2.medialakeapp.com/salesforce-redirect

The redirect URL must:

Use HTTPS.
Match the Medialake URL exactly.

Enable only the following scopes:

Offline Access
Documents and Images → Read
Saved Content → Read

Do not enable write, delete, send, subscriber, journey, or administration permissions.

Select Save or Finish.

>Activation delay: Salesforce can take up to five minutes to apply changes to an API Integration.

Step 4: Record the credentials

Record these values from the API Integration component:

Client ID
Client Secret
Authentication Base URI
Business Unit MID, if Medialake will connect to a specific Business Unit

>Save the secret now. Salesforce might not display the Client Secret again after the component is created. Store it in an approved password manager or secret-management system. Do not email it, paste it into a support ticket, or commit it to source control.

The Authentication Base URI should resemble:

https://mc563885gzs27c5t9-63k636ttgm.auth.marketingcloudapis.com/

For this example, the Medialake subdomain value is only:

mc563885gzs27c5t9-63k636ttgm

Do not use a Marketing Cloud browser address such as:

mc.s50.exacttarget.com

Step 5: Give the connecting user access

Open the package's Access tab.
Select the Business Unit containing the required Content Builder assets.
License the Marketing Cloud user who will complete the Medialake authorization.
Confirm that this user can view the required Content Builder folders and assets.

Web App integrations operate with the permissions shared by the package and the authorizing user. The user therefore needs both package access and Content Builder access.

Step 6: Enter the details in Medialake

In the Medialake Salesforce connection settings, enter:

Salesforce Client ID
Salesforce Client Secret
Salesforce subdomain
Business Unit MID, if required

The administrator should enter the Client Secret directly into Medialake or share it through an approved secure secret-management system. Do not send it through ordinary email or chat.

Select Connect and sign in using the licensed Marketing Cloud user.

Step 7: Verify the connection

After authorization, confirm that Medialake can:

Display the Content Builder folder hierarchy.
List creative assets from an authorised folder.
Download a test image or document.
Access only the intended Business Unit.

Initially select a small test folder before enabling a wider synchronisation.

Troubleshooting

Symptom	What to check
Setup is missing	The user needs Administration → General → Access.
Installed Packages is missing	The user needs Installed Package → Administer.
Invalid client	Verify the Client ID, Client Secret, and tenant subdomain.
Redirect URI mismatch	Ensure the URL in Salesforce exactly matches the Medialake callback URL.
Unauthorized or forbidden	Check the user's package licence, Content Builder permissions, and Business Unit access.
Folders are missing	Confirm the Business Unit MID and that the authorizing user can see those folders inside Content Builder.
Recently changed settings fail	Wait five minutes and reconnect.

Salesforce Marketing Cloud — Authentication