Obtain a Salesforce Marketing Cloud REST API access token using the TSSD-based /v2/token endpoint

In-depth guide

Steps

1. Create a Server-to-Server installed package in Marketing Cloud Setup and record the Client ID, Client Secret, and the tenant-specific subdomain (TSSD) shown on the package page.
2. POST to https://{TSSD}.auth.marketingcloudapis.com/v2/token with grant_type: client_credentials, client_id, and client_secret in the JSON body.
3. The response contains 'access_token', 'token_type': 'Bearer', 'expires_in' (seconds, typically 1080), and 'rest_instance_url' — store the rest_instance_url as the base for all subsequent API calls.
4. Include Authorization: Bearer {access_token} on all Marketing Cloud REST requests and use the rest_instance_url (not a generic domain) as the host.
5. Implement token caching: refresh the token when expires_in minus a safety buffer (e.g., 60 seconds) is reached rather than re-authenticating on every request.
6. For multi-business-unit scenarios, note that the token is scoped to the BU of the installed package — cross-BU operations require a separate installed package per BU or use of the MID-scoped endpoints.