I'm sure you can help me with this:

We are integrating our website with Marketing Cloud, so we are using JavaScript to send data into a Data Extension to start a Journey.

The Script works, it inserts the data in our DE's in all our development environments. The Java Script code is:

const authURL = 'https://auth.exacttargetapis.com/v1/requestToken';
const requestMethod = 'POST';
const requestHeaders = [{
  'Content-type': 'application/x-www-form-urlencoded',
  // 'Authorization':  `Bearer ${accessToken}`,
const authData = {

const authToken = sendHttpRequest(authData, authURL, requestMethod, requestHeaders);

 * dynamic ajax request
 * @param data  Object sent in the request
 * @param url  URL of the request
 * @param method  request method
 * @param headers  request headers array
 * @returns {Promise}
function sendHttpRequest(data, url, method, headers) {
  return new Promise(
    function(resolve, reject) {
      const xmlhttp = new XMLHttpRequest();
      xmlhttp.onreadystatechange = function() {
        if (xmlhttp.readyState === 4) {
          if (xmlhttp.status === 200) {
          } else {
            reject(new Error(this.statusText));
      xmlhttp.onerror = function() {
        reject(new Error(
          'XMLHttpRequest Error: ' + this.statusText));
      xmlhttp.open(method, url, true);

      headers.forEach((header) => {
        for (const prop in header) {
          xmlhttp.setRequestHeader(prop, header[prop]);


But when this code is inserted into our website we get errors.

Here’s a list of domains we’re using to test before we hit production

http://mocked.am.work.co/ https://int.aeromexico.io/ https://uat.aeromexico.io/ https://beta.aeromexico.com/

As you can see, we're getting the same error in every domain.

https://dl.dropboxusercontent.com/spa/9hdhy0x8uk9d155/1qtgjfpa.png https://dl.dropboxusercontent.com/spa/9hdhy0x8uk9d155/-nb8-pfv.png https://dl.dropboxusercontent.com/spa/9hdhy0x8uk9d155/iuej9rn1.png https://dl.dropboxusercontent.com/spa/9hdhy0x8uk9d155/xgt7k8f9.png

It´s seems that CORS setup needs to be done on Marketing Cloud, but we´re not finding any documentation in MC about this.

Reviewing the documentation of Rest API traffic authenticated using the auth.exacttargetapis.com, we found that is recommended to whitelist the following IP Addresses

We haven´t done this yet, because the error that we´re getting reflects that we´re reaching the MC Server before gets an error, so it doesn't seems that whitelist some IPs in our domains will solve the problem.


The error that you are experiencing is related to CORS headers. However, I'm deeply concerned that you are attempting to use a client-side JavaScript to make a REST API request to Marketing Cloud, as the OAuth credentials are easily accessible to anyone accessing website. You should always keep these credential secret and ensure that they are never made available on a public facing web server.

I'd suggest that you make a server-side request to update the Data Extension using the REST API. If you are unable to do this for some reason, then:

  1. Setup a CloudPage or Landing Page in Marketing Cloud to retrieve form values using the RequestParameter() AMPscript function and then use the InsertData() or UpsertData() AMPscript function to insert/update the values to a Data Extension on page load.
  2. Use XMLHTTPRequest to POST request the Data Extension field values from your web page to the CloudPage or Landing Page URL you created in Step 1 as form-data like this example.
| improve this answer | |
  • Hi Eliot! Thanks for replying back to me, is good talking to you! OK so I'm taking a look at the information you mention. I'm forwarding this to our developers. Regarding the OAuth, it is something we are taking care of asap. I should get back to you soon. – Esteban José Alvarado Nov 3 '16 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.