Salesforce Docs Portal

Tokenized Sending

Use Tokenized Sending to send contact data that is too sensitive to store in your Marketing Cloud Engagement database. You can take information from your own data systems and transmit it via API for use at send time.

Sensitive information can include these values:

  • Personally Identifiable Information (PII)
  • Protected Health Information (PHI)
  • Any other information stored on your servers

With Tokenized Sending, your account stores a single token per send attribute. This token resembles a standard email address or phone number but doesn’t include any information about the contact.

You can also store non-sensitive contact information for use in segmentation and other activities. You can use Tokenized Sending to personalize the sending and let these contacts interact with journeys, events, and activities. You can segment and filter contacts containing tokenized information.

Any tracking and deliverability information resides in your Engagement database for use without referencing any sensitive information. This feature relies on other data types, such as a subscriber key or subscriber ID.

Prerequisites

Review these prerequisites to implement this feature correctly.

  • You have basic knowledge about token and security concepts.
  • Contact an account executive to enable this feature when you create a new account. A new account ensures that no sensitive data is already stored.
  • Tokenized Sending functions as part of any account type. The feature operates as an enterprise-wide configuration across parent and child business units.
  • You need a separate tenant for Tokenized Sending.
  • Develop REST API calls for your data system to send the correct information at send time. These calls don’t occur within REST API framework.
  • Use the provided API specifications for getting and resolving tokens. Develop your code around these specifications for this feature to work.
  • This feature requires that your REST API implementation must use HTTPS (SSL, port 443). Your SSL server certificate can’t be self-signed.
  • Your REST API implementation handles up to 50 connections simultaneously and resolves batches of up to 500 tokens for each connection.
  • Each REST API connection resolves tokens and returns a response within 60 seconds.
  • Tokenized Sending uses token-to-send attributes as a 1:1 relationship. Create tokens, even when the subscriber is new or opting-in, and maintain the mapping of tokens to clear subscriber data.
  • All automatically processed STOP and UNSUBSCRIBE requests from your subscribers require tokens. If your Get Token API for SMS MOs is unavailable or doesn’t provide a token, you assume the responsibility to manually unsubscribe your subscriber.
  • Log all request and response payloads.
  • Monitor your production server and connectivity.
  • Test your REST API implementation before deployment using the provided testing harness.
  • To ensure proper connectivity, allowlist Engagement IP addresses.
  • This feature requires a subscriber key value for each contact in your account.
  • Email address or mobile number must be tokenized.
  • This feature applies to new data only.
Example
Example A token can look like e_6843846284@example.com. At send time, the Messaging Engine resolves that token for a clear email address, along with any other data used to personalize that message. Tokenized Sending occurs in system memory, not in your account database and can inject the fully rendered message into the mail transfer agent (MTA). This process is the first of many MTAs to handle the message before it reaches the final destination. The Tokenized Sending environment doesn’t include these additional MTAs, which can log messages passing through their servers.
  • Implement Tokenized Sending
    Before you enable Tokenized Sending in Marketing Cloud Engagement, review requirements and test the functionality. Note that some features don't work when Tokenized Sending is enabled but not yet implemented.
  • Token API Security
    Marketing Cloud Engagement can authenticate using your token resolver service with HTTP basic authorization or OAuth 2.0. Apex REST isn’t supported.
  • Tokenized Send Examples for Marketing Cloud Engagement
    View examples of Email Send and MobileConnect Send and Stop in Marketing Cloud Engagement.
  • Token Formats
    Use email address-based tokens or phone number-based tokens.
  • Supported Email Messaging Functionality
    Tokenized Sending supports functionality such as file-based imports, auto-response and forwards from Reply Mail Management, plus much more.
  • Supported MobileConnect Messaging Functionality
    Tokenized Sending supports the following MobileConnect functionality , such as file-based imports, stops and unsubscribes, send to all lists, and a mobile list.
  • Unsupported Tokenized Sending Features
    Tokenized Sending doesn’t work with certain Marketing Cloud Engagement features. Review this list for additional information.
  • No Token Queue for MO SMS Messages
    Your GET Token API must provide a token to Marketing Cloud Engagement in five or fewer tries. Otherwise, the system logs the message that there’s no token in a No Token Queue. This queue ensures you can still handle STOP messages and other important communications. You can also set up a custom data extract to retrieve the log. Contact your account executive for more information about enabling this custom data extract.
  • Get Token API Specification
    Use this information to provide token representation of plain text values. Marketing Cloud Engagement uses this API method to retrieve the token representation of a plain text value.
  • Resolve Token API Specification
    Marketing Cloud Engagement performs an HTTP POST to the URL that authenticates your sends. Your remote server replies in the specified format, allowing Engagement to parse and send to resolved email addresses or phone numbers.