Hi,
I have added automation as optional scope to my public app.
For some of my clients, there are “403 Forbidden Error: Missing ‘workflows-access-public-api’ Scope in External Auth Request” error logs.
I have checked their scopes through “https://api.hubapi.com/oauth/v1/access-tokens/:token” api, i can see automation scope present in response of access-token-metadata → scopes.
But got 403-forbidden for “/automation/v3/workflows”.
Any clarification would be greatly appreciated. Thanks!
Hey @Shrinath I replied to your question on this here yesterday which might help! https://community.hubspot.com/t5/APIs-Integrations/403-Forbidden-Error-Missing-workflows-access-public-api-Scope-in/m-p/1176586/highlight/true#M83234
I didnt get from you reply.
could you please clarify once again.
@TomM2
what do you mean by “above subscriptions”?
@Shrinath does the account you’re trying to integrate with have workflows? IE is it a professional or above subscription within the account?
Just for future reference, this community is commented on and monitored by volunteers, if you don’t get an answer you understand or the answer you want I’d recomend commenting on your initial post as it means the conversation is within one place, meaning more people can jump in to offer help. If you open multiple posts on the same issue it significantly increases the chances of your post being ignored or marked as spam.
@TomM2
Thanks for the reminder — I’ll make sure to keep the conversation in one thread going forward.
Yes, it is professional account. It also has workflows.
And I dont have idea about subscriptions.
Any further suggestions would be appreciated!
Hi @Shrinath ,
Thank you for reaching out to the Community!
I’d like to invite some community members who are subject matter experts to join this conversation.
@SteveHTM @stefen @AlexOnPoint - Would you be able to share any insights on this? Your expertise would be greatly appreciated.
Best regards,
Victor
Hi @Shrinath,
This error can occur if the connected HubSpot account lacks the necessary subscription level or permissions to use workflows, even when the OAuth scope is present. Double-check that your clients’ HubSpot accounts include access to workflows and that the user connected to your app has the required permissions.
If everything appears correct and the issue persists, ask your clients to re-authenticate the app. Sometimes, updating or re-approving permissions resolves scope-related problems.
If you need further assistance, please share more details about the affected accounts or any additional error messages. I am happy to help you troubleshoot further.
Hi @GiantFocal ,
Thanks for your response.
To help me resolve the issue, could you please clarify:
What specific subscription level(s) are required for a HubSpot account to access workflows when using a public app ?
What exact user permissions are needed for the connected user to authorize workflow access correctly?
Additionally, if there’s any documentation link or list that outlines the required permissions/subscriptions for workflow-related scopes, that would be very helpful.
Thanks again for your assistance.
Hi @Shrinath I know. The short version in 2025 is that having the generic automation scope isn’t enough for the Workflows endpoints.
Your public app must explicitly request workflows-access-public-api, and the user who installs must approve that exact scope during OAuth. You can confirm which scopes are required by checking the endpoint’s “Requirements” in the HubSpot API docs and by adding the scope to your app settings and install URL before re-auth
Even with the right OAuth scope, HubSpot will return 403 if the target portal doesn’t actually include the Workflows tool or the installing user lacks permission to use it.
Workflows access today requires a Professional or Enterprise subscription on the relevant Hub, including Smart CRM or Data Hub where applicable. If the portal only has Starter or Free, the API will stay forbidden even though the token lists the scope. You can validate the feature availability here under “Available with” before testing again
Two quick checks that solve most cases: re-authenticate the app after you add workflows-access-public-api so the account explicitly approves the new scope, and have the installer be a Super Admin or a user with App Marketplace Access plus permission to view and edit Workflows.
If you recently changed scopes, use a fresh install link and confirm your token introspection shows the new scope on the latest token, not a cached one.
One tiny detail to confirm on your side: did you add workflows-access-public-api as required or optional in the app, and is it included in the exact scope= or optional_scope= parameters on the install URL you shared with clients?
When this hinges on reliable two-way sync, Stacksync handles the mapping and timing so records stay consistent without manual patches.