Hi we were given an ExactTarget php application to port from an older Magento installation to a new Magento installation. This code is based on the ExactTargetSoapClient, soap-wsse.php and xmlseclibs.php. This application runs fine in our development environment and creates a subscriber as it should on the all subscriber list. When we move this to the clients domain and use the exact same set of credentials and the same wsdl URL it fails with the response of An invalid security token was provided. Having looked for differences in the SOAP being sent to exact target in the working request and the failed request I see only the security information specifically the nounce and the time. Both of these would seem to me to be expected to be different on different domains. Any Ideas of how to fix this issue would be greatly appreciated.

Here are the only lines that differ in the 2 requests.


            <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2016-05-19T18:04:35Z</wsu:Created>


            <wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">2016-05-19T18:05:56Z</wsu:Created>

Here is the Soap Fault

    <?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
         <wsu:Timestamp wsu:Id="Timestamp-649497a3-c740-4da3-8f0e-77fc9e4eb36a">
         <faultcode xmlns:q0="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">q0:InvalidSecurityToken</faultcode>
         <faultstring>An invalid security token was provided</faultstring>
  • Are you sure that the security token that you are using is the correct one? – joe May 20 '16 at 15:57
  • The API user id and the password are valid. My question would be the wsdl URL which I can only say it works in development why would it not work on a different domain? The 2 request are identical without the time and nonce so unless Sales Force ties domain into authentication in ways I don't know about I assume everything is correct. – Michael Weaver May 20 '16 at 20:27

I was experiencing the same error until I noticed that ExactTarget will return this error if the created timestamp passed to it is in the future as per ET's own current time. Adjusting the time of the request server to a few minutes in the past worked for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.