I am trying to get access token using SSJS, but to retrieve client id and client secret I want to use an ampscript function - DecryptSymmetric.

When I use this function I get '500 - Internal server error'.

<script runat="server">
    var fullToken = getToken()

function ampScript(code) {
    var ampBlock = '\%\%[' + code + ']\%\%';
    return Variable.GetValue('@response');

    function getToken(){

       var clientId = ampScript("SET @response = DecryptSymmetric('enctryptedClientId', 'AES','symmetricKeyValue', @null,'saltKeyValue', @null, 'InitializationVectorKeyValue', @null");
       var clientSecret = ampScript("SET @response = DecryptSymmetric('enctryptedClientSecret', 'AES','symmetricKeyValue', @null,'saltKeyValue', @null, 'InitializationVectorKeyValue', @null");

        var authEndpoint = 'xyz.auth.marketingcloudapis.com';
        var payload = {
                client_id: clientId,
                client_secret: clientSecret,
                grant_type: "client_credentials"
        var url = authEndpoint + '/v2/token';  
        var contentType = 'application/json';

        var accessTokenRequest = HTTP.Post(url, contentType, Stringify(payload));
        if(accessTokenRequest.StatusCode == 200) {
                var accessToken = Platform.Function.ParseJSON(accessTokenRequest["Response"][0]).access_token;
        var token = 'Bearer ' + accessToken;
        return token; 
  • try removing the escape slashes in your AMPscript blocks. Maybe do something like var ampBlock = '%'+'%[' + code + ']%' + '%'; instead. I have found those cause me more headaches then anything in SSJS. Also wrap it in a try/catch to see if you can get more details on the error. Nov 1, 2022 at 15:09
  • Unfortunately, it didn't resolve the problem
    – jjalbert
    Nov 1, 2022 at 23:16

1 Answer 1


nasty little thing: symmetricKeyValue etc - If these are hardcoded, plain password, salt and IV, which it looks like, then the order of the arguments in the function is different.

try it like so:

/* plain key params as variable */ 

/* decryption, note change in @null / variable order */
SET @clientId = DecryptSymmetric(@clientIdEncrypted, 'AES', @null, @pw, @null, @salt, @null, @iv)
SET @clientSecret = DecryptSymmetric(@clientSecretEncrypted, 'AES', @null, @pw, @null, @salt, @null, @iv)

The order in your code were correct if you referenced key management params by their external Keys. But with passwords physically in your code, the above is the right order (@nulls first).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .