403 Forbidden – Missing 'workflows-access-public-api' Scope, Even When 'automation' Scope is Present

Develop, Build & Integrate APIs & Integrations
1

Hi HubSpot Community ,

I’m encountering an issue with my public app where a few client accounts are receiving the following error:

403 Forbidden Error: Missing ‘workflows-access-public-api’ Scope in External Auth Request

Here’s some background:

  • I’ve added the automation scope as optional in the app’s authorization URL.
  • For the affected client accounts, I’ve verified the access token metadata via https://api.hubapi.com/oauth/v1/access-tokens/:token , and the automation scope is indeed present in the scopes list.
  • However, when making a call to the endpoint /automation/v3/workflows, the response is a 403 Forbidden error.

I received the following explanation from community:

This error can occur if the connected HubSpot account lacks the necessary subscription level or permissions to use workflows, even when the OAuth scope is present.

I’d appreciate help in understanding:
What subscription level(s) are required for a HubSpot account to access workflows through the API ?
What specific user permissions are needed for the connected user to successfully use the automation and workflows-access-public-api scopes?
Why does the API return a 403 Forbidden error even when the scope is present in the access token — shouldn’t the presence of the scope imply the user has access?

Any guidance would be greatly appreciated.
Thanks in advance!

2

Hi @Shrinath
Thank you for reaching out to the Community!
I’d like to invite some community members who are subject matter experts to join this conversation.
@coldrickjack @SteveHTM @GiantFocal - Would you be able to share any insights on this? Your expertise would be greatly appreciated.
Best,

Victor

3

I have created a test account of hubspot and connected my app, And Im not getting any 403 error.
Does test account has required subscription? Which is missing in my clients account.
Or How does it work?
I request the Hubspot-Experts to guide me through this.
Hoping for Response from Hubspot Community.
Thank You.
@Victor_Becerra @coldrickjack @SteveHTM @GiantFocal

4

Hey @Shrinath :waving_hand: For apps using a Public App for auth, the subscription level of the destination is what is significant for functionality. So if the clients don’t have access to Workflows, they won’t be able to use your app for anything to do with Workflows. App Test account have access to most features, which is likely why you don’t get an error when installing there. — Jaycee