topic Re: Using hubspot.fetch() to call the hubspot API in APIs & Integrations

Using hubspot.fetch() to call the hubspot API

OStangenberg — Tue, 21 Oct 2025 14:20:44 GMT

I am working on a CRM extension with 2025.2 and would like to use hubspot.fetch() to directly call the Hubspot API. For me the fact that the api.hubapi.com is in some examples for the permittedUrls implies that this should be possible. But if i try to call it from our portal hosted in eu1 i get an error

Hub *** is unknown to this Hublet, but it appears to exist in Hublet eu1

I then tried making the call to api-eu1.hubapi.com instead but that just resulted in a 401.

So is there a way to make this work? Or do i always have to go through a backend?

Re: Using hubspot.fetch() to call the hubspot API

TOlis — Tue, 21 Oct 2025 14:52:15 GMT

You can’t really call HubSpot’s own REST API directly from a CRM extension using hubspot.fetch(). It appears to work, but it’s blocked by design. The unknown to this hublet error happens because your portal is in EU1, but api.hubapi.com points to the US hublet. When you switch to api-eu1.hubapi.com, it connects to the right region but still fails with 401 since hubspot.fetch() doesn’t include your auth context for HubSpot’s own domains.

The right way to do it is through a backend. You can use HubSpot Functions or any simple external service to handle the API call. Store your private app token as a secret, make the API request from there, and just call that function from your extension. That keeps your token secure and avoids CORS or hublet issues. Basically, think of hubspot.fetch() as something for safe external calls, not internal API access

Re: Using hubspot.fetch() to call the hubspot API

RubenBurdin — Thu, 30 Oct 2025 17:27:30 GMT

Hi @OStangenberg

You’re reading it right. hubspot.fetch() is for calling external services you allowlist, not HubSpot’s own APIs. It won’t carry your HubSpot auth context to api.hubapi.com or api-eu1.hubapi.com, so you’ll hit hublet mismatch or 401. The supported pattern is front end > your backend (or HubSpot Functions) > HubSpot REST with OAuth or a private app token stored as a secret, and you add only your backend URL to permittedUrls (https://developers.hubspot.com/docs/apps/developer-platform/add-features/ui-extensibility/fetching-data )

On the server side, authenticate with OAuth or private app access tokens and return just what the card needs. That keeps tokens off the client, avoids CORS, and works across regions consistently in 2025
(https://developers.hubspot.com/docs/apps/legacy-apps/authentication/intro-to-auth )

One quick question: are you distributing this as a marketplace app or only for a single account? It affects whether you choose OAuth vs a private app token. When this hinges on reliable two-way sync, Stacksync handles the mapping and timing so records stay consistent without manual patches.

Re: Using hubspot.fetch() to call the hubspot API

OStangenberg — Thu, 30 Oct 2025 22:52:42 GMT

This app is only deployed to a single account and not intended for the marketplace