topic Re: OAuth Connection Error for Non-Super Admin Users in APIs & Integrations

OAuth Connection Error for Non-Super Admin Users

SSaraf — Mon, 04 Mar 2024 16:53:09 GMT

I have reviewed several posts on this community for a connection error that is commonly experienced, but they have not helped in resolving our issue.

We are integrating one of our applications with HubSpot and are running tests with our Free HubSpot CRM to ensure that the end users of our application can connect to HubSpot successfully via OAuth.

Our application has thousands of users and we would like each user to be able to connect to their HubSpot CRM* via OAuth after logging in to our application with their individual credentials: so each user gets assigned a unique access token and refresh token to be able to independently authenticate, log in, and connect to their HubSpot CRM* from our application.

By *connect to their HubSpot CRM I mean: Connect to their HubSpot CRM account by installing the app that we have set up in our HubSpot Developer account via our app's Install URL- which is generated based on our app's client id, redirect URL, and scope configuration.

Our app is Not Verified and not listed in the HubSpot marketplace as we are in the testing phase.

Here's the issue:

Users who do not have a HubSpot Super Admin role, get this error while trying to connect via OAuth: Couldn't complete the connection You don't have permission to connect this app. Users with Super Admin role are able to successfully connect via OAuth.

Other Details:

I found this post: https://community.hubspot.com/t5/APIs-Integrations/HubSpot-OAuth-FAQ/m-p/262729 to be insightful and understand that "Whether or not an app can be installed depends on the intersection of the app's required scopes, the account’s included tools, and the authorizing user's roles."
We have made sure the non-Super Admin users are assigned the required user permissions (enabled App Marketplace Access & Property Settings) that align with our apps required scopes, but we are missing something as we are unable to resolve the above connection error for users who are not Super Admins. Here is a screenshot of the permissions assigned to our Non-Super Admin users permissions

Here is a screenshot of the Scopes assigned to our app

The reason why we require each user to authenticate is because we want each user to have the autonomy to communicate with their HubSpot by installing our app via OAuth integration in their HubSpot account- to be able to send data from our application to their HubSpot CRM using their independent access+refresh tokens . Most importantly not depend on the super admin user to establish a connection for them to be able to communicate with their HubSpot CRM.

As each user logs in to our application independently, at their will, we want to continue offering a seamless experience to them-from logging in to our application-to connecting with their HubSpot account-and thcen being able to send data they wish to from our application to their HubSpot CRM.

Are we experiencing this because we are testing with a Free HubSpot CRM? What specific details can I share here for someone to assist me with this issue?

Warmly

Sonia

Re: OAuth Connection Error for Non-Super Admin Users

dsmarion — Fri, 09 Feb 2024 20:14:30 GMT

I believe only super admins can install apps regardless of the app permissions required.

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Tue, 20 Feb 2024 23:00:05 GMT

@Jnix284 Hi Jennifer, tagging you for any help on this. Thank you.

Re: OAuth Connection Error for Non-Super Admin Users

Jnix284 — Wed, 21 Feb 2024 12:54:48 GMT

Hi @SSaraf, happy to help you find an answer here!

@Mike_Eastwood any insight on which scope might be triggering the requirement to be installed by Super Admins?

There's an OAuth error and this is beyond my experience with marketplace apps.

@SSaraf you might also be interested in attending the upcoming Developer HUG event about Navigating the HubSpot App Marketplace Journey where you can learn from experts in the community like Mike who have successfully built and launched apps.

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Wed, 21 Feb 2024 21:15:01 GMT

Thanks @Jnix284 for connecting me to @Mike_Eastwood Mike, please let me know if I can share more details to troubleshoot this issue. I have gone ahead and registered for the Developer HUG event tomorrow. Appreciate your help!

Re: OAuth Connection Error for Non-Super Admin Users

Jnix284 — Wed, 21 Feb 2024 21:17:24 GMT

You're welcome @SSaraf, I hope you can get the answers you're looking for at the event tomorrow!

Re: OAuth Connection Error for Non-Super Admin Users

Mike_Eastwood — Wed, 21 Feb 2024 22:32:46 GMT

Hi @SSaraf

Recently I've had issues with permissions across several HubSpot accounts and I'd assumed it was our new "Partner" Role which HubSpot have been rolling out. In several accounts I haven't been able to do things I have permissions for.

While I haven't tested your exact scenario (thank you for being so specific) I assume it's a bug.

Sorry I can't help.

Mike

p.s. thank you for the mention @Jnix284

Here to learn more about HubSpot and share my HubSpot Knowledge. I'm the founder of Webalite a Gold HubSpot Partner Agency based in Wellington, New Zealand and the founder of Portal-iQ the world's first automated HubSpot Portal Audit that helps you work smarter with HubSpot.

Re: OAuth Connection Error for Non-Super Admin Users

Jnix284 — Thu, 22 Feb 2024 01:52:35 GMT

Thanks for sharing your insights @Mike_Eastwood, do you have any recommendations for who to contact on the marketplace app team when encountering a bug?

Re: OAuth Connection Error for Non-Super Admin Users

louischausse — Thu, 22 Feb 2024 17:04:40 GMT

I often noticed that non super admins can't install oAuth app even if they have the App Marketplace access toggled on. Never really understood why. Seems like a bug. What I usually do in those cases, is I install the app for the users (I'm a super admin or partner admin in most portals I worked on). I understand this is not possible since you have thousands of users.

But what I am having a hard time to understand is your use case. I have been working in HubSpot for more than 10 years and I never seen a use case where an app needs to be installed by all users except for Gmail and Outlook. Most apps in the HubSpot App Marketplace are installed once by a super admin and then every HubSpot user can uses them without authentication.

Maybe what you are trying to do is overkill? Maybe a private app authentication or an oAuth app installed by a super admin at the portal level would be enough.

If your use case really requires everyone to authenticate then you will need to fix this situation, but I am aligned with @Mike_Eastwood here, it is probably a bug because you have the App Marketplace access toggled on and this is what is mentioned in the doc. You did everything right.

Since you are on the Free tier of HubSpot you don't have access to Support, but I would consider take the Starter plan just to have access to Support and report this bug.

I am curious of what some fellow hs community developers thinks about this but I don't know who is the most experienced with oAuth. @dennisedson who is your go to person for oAuth?

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Sun, 25 Feb 2024 03:06:04 GMT

@louischausse , thanks for your response. The reason why we require each user to authenticate is because we want each user to have the autonomy to communicate with HubSpot with their independent access+refresh tokens and send Companies/ Contacts data from our application via the OAuth integration to HubSpot. Most importantly not depend on the super admin user to establish a connection for them to be able to communicate with HubSpot.

As each user logs in to our application independently, at their will, we want to continue offering a seamless experience to them-from logging in to our application-to connecting with HubSpot-and then being able to send data they wish to from our application to HubSpot.

Thanks for tagging @dennisedson - I am hoping he can offer some insights.

There is a post about this from 2019 to fulfill a similar use case : https://community.hubspot.com/t5/APIs-Integrations/OAuth-issue-requiring-superadmin/m-p/250649/page/2 From the responses in this post, this appears to be an issue with 'free' accounts which was going to be fixed in 2019, but may not be resolved yet. I am tagging the contributers to this post and hoping they can help. @IsaacTakushi @sachinr @RBlack @felipeecst @voicify_gavin @Tegen @taylorbarstow @FStreicher Nice to meet you all. Do you have any latest insights on this topic? Appreciate your help!

‎

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Sun, 25 Feb 2024 03:10:04 GMT

Thanks @Mike_Eastwood I attended the Developer HUG event on Feb 22nd and found your session very insightful. Appreciate you sharing your knowledge & expertise with the community!

Re: OAuth Connection Error for Non-Super Admin Users

louischausse — Mon, 26 Feb 2024 13:31:39 GMT

Thanks for the clarification.

Again, in most cases, it is not because your users have individual authentication credentials for your app that they also need to individually connect their app to HubSpot using oAuth.

In most cases, having a super admin connecting the app to HubSpot ONCE will be sufficient.

After that, users need to sign in to the app (without enabling an oAuth connection to HubSpot) and they are good to go.

Let me give you an example with a very popular HubSpot integration: PandaDoc.

When an organization wants to start using PandaDoc inside of HubSpot records, a super admin will setup the integration by going through the HubSpot oAuth flow. They do this just once (not every time a user wants to use the PandaDoc app inside of HubSpot). After that one-time connection is done, users will start to see the PandaDoc card in the left sidebar of contacts and deals records. If they want to interact with this PandaDoc card (e.g. to create a document) they will need to sign in to PandaDoc using their usual PandaDoc credentials. They won't need to go through the HubSpot oAuth flow.

You should probably revise your integration so only admins need to install the app once and that your users can use it using their regular credentials.

I hope this helps.

Sincerely yours,

The Wizard of Hubs 🧙‍♂️

Don't forget to mark my reply as a solution if you are satisfied. If not, do not hesitate to ask me anything!

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Tue, 27 Feb 2024 20:41:17 GMT

Hello- @HubDoPete @Teun Nice to meet you! I am new to HubSpot and I recently attended the Developer HUG event on Feb 22nd. Thanks for sharing your knowledge & expertise with the community- very helpful for HubSpot newbies like me. I wanted to reach out to you and check if you can offer any guidance on the OAuth issue that I am have described in my post.

Thanks for any insights you can offer.

Warmly

Sonia

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Sat, 02 Mar 2024 19:25:49 GMT

@JesseCunningham Thank you for any guidance you can offer on this issue!

Re: OAuth Connection Error for Non-Super Admin Users

SSaraf — Mon, 04 Mar 2024 17:07:07 GMT

Per my research: this issue is specific to only Free HubSpot subscriptions, which is what we are testing with. Please upvote this reply if my understanding is correct.