Bolt.new AI and Pardot integration: Step-by-Step Guide 2025

To integrate Bolt.new with Pardot, you don’t connect “Bolt itself” to Pardot. Instead, you write normal backend code inside a Bolt.new project that calls the real Salesforce Pardot (now called Marketing Cloud Account Engagement) REST API. The key is: Pardot requires Salesforce OAuth 2.0, and every API call must include a Salesforce access token plus a Pardot Business Unit ID. In Bolt.new, you store these values in environment variables and call Pardot’s REST endpoints from your backend routes. That’s the whole integration pattern.

 

What Integration Actually Means in Bolt.new

 

In Bolt.new you build a small API server (Node, Python, etc.) and that server talks to Pardot through its public REST API. Bolt doesn’t have any special connector — you use standard OAuth, HTTPS requests, and env vars.

• You authenticate using Salesforce OAuth 2.0 Web Server flow.
• You get an access\_token from Salesforce.
• You attach that token to each Pardot API request using the Authorization: Bearer header.
• You include the Pardot Business Unit ID in every request using the Pardot-Business-Unit-Id header.
• You call Pardot REST endpoints like /api/v5/objects/prospects.

 

Step‑by‑step: How you integrate Bolt.new with Pardot

 

This path is the same whether in Bolt.new or your production environment.

• Create a Salesforce Connected App. This gives you a client_id and client_secret so your Bolt backend can get OAuth tokens.
• Enable OAuth scopes. You need: refresh_token, offline_access, and pardot\_api.
• Get the Pardot Business Unit ID. Inside Salesforce: Setup → Pardot → Account Engagement → Business Unit → copy the value (looks like “0UvXXXXXXXX”).
• Store secrets in Bolt.new environment variables. In the Bolt project: Environment tab. Add:
  • SALESFORCE_CLIENT_ID
  • SALESFORCE_CLIENT_SECRET
  • SALESFORCE\_USERNAME (only if using username-password flow)
  • SALESFORCE\_PASSWORD (only if using username-password flow)
  • SALESFORCE_OAUTH_REDIRECT\_URI
  • PARDOT_BUSINESS_UNIT\_ID
• Implement an OAuth token route. In Bolt.new you create an endpoint to fetch a Salesforce access token.
• Call Pardot endpoints using the token. Use the token + BU ID in headers.

 

Working Example (Node.js inside Bolt.new)

 

This shows a real request: get an OAuth token, then fetch prospects.

// server.js in Bolt.new
import express from "express"
import axios from "axios"

const app = express()
app.use(express.json())

// Route to get Salesforce OAuth token
app.get("/auth/salesforce", async (req, res) => {
  try {
    const resp = await axios.post("https://login.salesforce.com/services/oauth2/token", null, {
      params: {
        grant_type: "client_credentials", // works if enabled in your Connected App
        client_id: process.env.SALESFORCE_CLIENT_ID,
        client_secret: process.env.SALESFORCE_CLIENT_SECRET
      }
    })

    res.json(resp.data)
  } catch (e) {
    res.status(500).send(e.response?.data || e.message)
  }
})

// Example: retrieve Pardot prospects
app.get("/pardot/prospects", async (req, res) => {
  try {
    // You should cache this token; keeping it simple here
    const tokenResp = await axios.post("https://login.salesforce.com/services/oauth2/token", null, {
      params: {
        grant_type: "client_credentials",
        client_id: process.env.SALESFORCE_CLIENT_ID,
        client_secret: process.env.SALESFORCE_CLIENT_SECRET
      }
    })

    const accessToken = tokenResp.data.access_token

    const prospectsResp = await axios.get(
      "https://pi.pardot.com/api/v5/objects/prospects",
      {
        headers: {
          Authorization: `Bearer ${accessToken}`,
          "Pardot-Business-Unit-Id": process.env.PARDOT_BUSINESS_UNIT_ID
        }
      }
    )

    res.json(prospectsResp.data)
  } catch (e) {
    res.status(500).send(e.response?.data || e.message)
  }
})

app.listen(3000, () => {
  console.log("Bolt server running on port 3000")
})

 

Important Concepts Explained Simply

 

• OAuth token: A temporary key proving your app is allowed to call Salesforce/Pardot.
• Business Unit ID: Pardot’s internal routing key. Without it, Pardot rejects requests.
• Environment variables: Secure vault for secrets so they never appear in code.
• Backend in Bolt.new: A Node/Python server running in a sandbox. This is where API integrations live.

 

How This Works in Real Production

 

Bolt.new lets you prototype fast; production requires storing secrets in a secure system, rotating tokens, implementing refresh tokens, and adding error handling for Salesforce rate limits. But the integration pattern stays the same: your backend obtains Salesforce OAuth tokens and calls Pardot’s REST endpoints using HTTPS.