topic Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com in APIs & Integrations

401 Error with User-Level OAuth Token for mcp.hubspot.com

kavin_kr — Thu, 21 Aug 2025 06:51:51 GMT

Hello,

I'm developing a multi-tenant chat application that integrates with HubSpot, similar to the ChatGPT connector. I'm using a Public App to handle the OAuth flow for multiple users.

I've successfully completed the OAuth 2.0 flow using the mcp.hubspot.com endpoints:

Authorization URL -> https://mcp.hubspot.com/oauth/authorize
Token URL -> https://mcp.hubspot.com/oauth/v1/token

The Problem:

When I use this access token to initialize the MCP client for the mcp.hubspot.com server, the authentication fails with a 401 Unauthorized error with the message: "Error POSTing to endpoint (HTTP 401): This endpoint requires a user level OAuth token"

Possible Issue:

I've verified access token using both the introspection endpoint (https://mcp.hubspot.com/oauth/v3/token/introspect) and the access token info endpoint (https://api.hubapi.com/oauth/v1/access-tokens/{token}). Both confirm the token is active and contains user-specific details like user, user_id, hub_id, and app_id. I did notice that within the token information, there is a nested field "signed_access_token": { "isUserLevel": false }, which is confusing.

Could anyone please clarify why this token isn't being accepted? Is there a different scope or process required specifically for the mcp.hubspot.com service?

Thank you the help.

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

Jigar_Thakker — Thu, 21 Aug 2025 15:05:10 GMT

Hi @kavin_kr,

The MCP endpoint is expecting a user‑level OAuth token.

Re-authenticate using the standard Authorization Code OAuth flow so a human user approves the app and you receive a user-bound access token (avoid private app tokens or server-to-server).
Get a fresh access token and initialize your MCP client with that new token.
If you’re using refresh tokens, ensure you refresh the access token before it expires to prevent 401s.

Confirm the token is tied to a specific user by calling GET /oauth/v1/access-tokens/{token} and checking the returned user information. https://developers.hubspot.com/docs/guides/api/app-management/oauth-tokens

If this helps, feel free to mark it as the solution ✔️ and give it an upvote 👍 !

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

kavin_kr — Thu, 21 Aug 2025 20:14:22 GMT

Hi @Jigar_Thakker ,

Thanks for the reply. I followed the steps from the docs, but I'm still getting the same error. Actual values are replaced with $VALUES for brevity.

1. OAuth URL

https://app.hubspot.com/oauth/authorize?response_type=code&client_id=$CLIENT_ID&redirect_uri=$REDIRECT_URI&scope=oauth&optional_scope=$OPTIONAL_SCOPE&state=$STATE

Here is the OAuth screen for your reference.

2. Token Exchange

curl -X POST "https://api.hubapi.com/oauth/v1/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=authorization_code" \
     -d "code=$AUTH_CODE" \
     -d "client_id=$CLIENT_ID" \
     -d "client_secret=$CLIENT_SECRET" \
     -d "redirect_uri=$REDIRECT_URI"

3. Verified the access token metadata

curl -X GET "https://api.hubapi.com/oauth/v1/access-tokens/$ACCESS_TOKEN" \
     -H "Authorization: Bearer $ACCESS_TOKEN"

Response:

{ "token": "...", "user": "...", "hub_domain": "...", "scopes": [ "oauth", "crm.objects.contacts.read", "crm.objects.contacts.write", "crm.objects.companies.write", "crm.objects.companies.read", "crm.objects.deals.read", "crm.objects.deals.write", "crm.objects.owners.read" ], "signed_access_token": { "expiresAt": 1755802709136, "scopes": "...", "hubId": ..., "userId": ..., "appId": ..., "signature": "...", "scopeToScopeGroupPks": "...", "newSignature": "...", "hublet": "...", "trialScopes": "", "trialScopeToScopeGroupPks": "", "isUserLevel": false, "installingUserId": ..., "isServiceAccount": false, "isPrivateDistribution": false }, "token_type": "access", "user_id": ..., "app_id": ..., "hub_id": ..., "is_private_distribution": false, "expires_in": 1798 }

4. But when I tried to initialize the MCP client with that access token, it is throwing the same error.

"Error POSTing to endpoint (HTTP 401): This endpoint requires a user level OAuth token"

Let me know if you need any other details.

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

keurcien — Fri, 22 Aug 2025 20:34:11 GMT

Hi, is the https://mcp.hubspot.com endpoint open to any client? Would love to have read some docs about it.

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

kavin_kr — Fri, 22 Aug 2025 20:55:54 GMT

@keurcien There isn’t any documentation available for it yet. I came across it through their blog and decided to test it out - https://product.hubspot.com/blog/unlocking-deep-research-crm-connector-for-chatgpt.

I’m hoping it will be available for public apps as well, so we don’t need to handle granular token access ourselves and can rely on the built-in permission model instead.

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

sejal_parikh — Tue, 26 Aug 2025 02:15:07 GMT

Hi @kavin_kr

We don't have a general-use MCP connector available yet. We will keep you posted when we do release it. I'm curious to learn what type of multi-tenant chat application you are building and what use cases would it solve for.

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

kavin_kr — Tue, 26 Aug 2025 02:36:21 GMT

Hi @sejal_parikh ,

I’m building a centralized AI hub for enterprises where they can interact with different models using their enterprise data.

Do you have plans to support public use? If so, any ETA would be helpful.
If there are no plans yet, our use case is very similar to your existing ChatGPT connector. Could you provide a special setup similar to what you did for ChatGPT?
If neither of the above is possible, could you provide some guidance on setting up a connector on top of the existing architecture?

Additional context:

The app needs to be public so that multi-user OAuth is possible.
How should we manage user permissions? The access token reflects the permissions granted at the time of initialization, but if a user’s permissions are later revoked, the token may still allow access. This creates a risk of resources being accessed through the AI even though the user no longer has access. Any guidance on how to properly validate user access would be very helpful.

Thanks

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

rrrk — Sat, 06 Sep 2025 07:21:32 GMT

Hi, I went through the docs https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-hubspot-mcp-server here as well, implemented the oauth server but when I try to initialize MCP client, same error:
> This endpoint requires a user level OAuth token

My scopes: crm.objects.contacts.write, oauth, crm.objects.companies.read, crm.objects.contacts.read

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

elie222 — Mon, 29 Sep 2025 06:49:36 GMT

Facing this same issue. Would love to hear an update. The docs feel lacking atm

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

chighsmith — Mon, 29 Sep 2025 21:18:11 GMT

Hi @elie222,

Thank you for posting to the Community!

Were you able to test out @Jigar_Thakker's Accepted Solution above? If so, where are you getting stuck? Can you share the steps you've taken thus far?

Thank you!

Cassie, Community Manager

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

kavin_kr — Tue, 30 Sep 2025 21:37:57 GMT

For those who are still facing this issue, follow the steps in the repo for the HubSpot Remote MCP integration - https://github.com/hubspotdev/user-level-app-template

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

sejal_parikh — Wed, 01 Oct 2025 04:01:10 GMT

Hey everyone, we launched beta for the remote MCP server at INBOUND. Here's the latest landing page on that https://developers.hubspot.com/mcp

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

elfs — Sun, 21 Dec 2025 21:04:34 GMT

the solution still doesn't work for me and this post from @kavin_kr is exactly what I got. the `signed_access_token.isUserLevel` is false. no matter using token endpoint https://api.hubapi.com/oauth/v1/token or https://mcp.hubspot.com/oauth/v3/token

Re: 401 Error with User-Level OAuth Token for mcp.hubspot.com

elfs — Sun, 21 Dec 2025 21:50:27 GMT

figured it out with the help of support assistant: hubhelp@hubspot.com

The problem is about the application itself created via `hs project upload`. it must have a file src/app/user-level-app-hsmeta.json with attribute like this: I'm using mine as example:
Notice it must have config isUserLevel equals to true

{
"uid": "my-uid",
"type": "app",
"config": {
"description": "Ari is your AI powered assistant",
"name": "Ari",
"distribution": "marketplace",
"isUserLevel": true,
"auth": {
"type": "oauth",
"redirectUrls": [
"http://localhost:4000/oauth2/hubspot-callback",
"https://api-dev.ari.ariso.ai/oauth2/hubspot-callback",
"https://api.ari.ariso.ai/oauth2/hubspot-callback"
],
"requiredScopes": [
"oauth",
"crm.objects.contacts.read",
"crm.objects.companies.read",
"crm.objects.deals.read"
],
"optionalScopes": [
"crm.objects.products.read",
"crm.objects.orders.read",
"crm.objects.line_items.read"
],
"conditionallyRequiredScopes": []
},
"permittedUrls": {
"fetch": [
"https://api.hubapi.com"
],
"iframe": [],
"img": []
},
"support": {
"supportEmail": "support@ariso.ai",
"documentationUrl": "https://example.com/docs",
"supportUrl": "https://example.com/support",
"supportPhone": "+18005555555"
}
}
}