# 403 Forbidden – Missing 'workflows-access-public-api' Scope, Even When 'automation' Scope is Present **URL:** \ **Category:** APIs & Integrations\ **Tags:** workflows\ **Created:** [July 17, 2025, 9:06am UTC](https://community.hubspot.com/t/403-forbidden-missing-workflows-access-public-api-scope-even-when-automation-scope-is-present/136386 "2025-07-17T09:06:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Shrinath](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@Shrinath](https://community.hubspot.com/u/Shrinath)\ **Post date:** [July 17, 2025, 9:06am UTC](https://community.hubspot.com/t/403-forbidden-missing-workflows-access-public-api-scope-even-when-automation-scope-is-present/136386/1 "2025-07-17T09:06:59Z")
Hi HubSpot Community , I’m encountering an issue with my public app where a few client accounts are receiving the following error: > **403 Forbidden Error** : Missing ‘workflows-access-public-api’ Scope in External Auth Request Here’s some background: - I’ve added the **automation** scope as **optional** in the app’s authorization URL. - For the affected client accounts, I’ve verified the access token metadata via [https://api.hubapi.com/oauth/v1/access-tokens/:token](https://api.hubapi.com/oauth/v1/access-tokens/:token) , and the automation scope is indeed present in the scopes list. - However, when making a call to the endpoint /automation/v3/workflows, the response is a 403 Forbidden error. I received the following explanation from community: > This error can occur if the connected HubSpot account lacks the necessary subscription level or permissions to use workflows, even when the OAuth scope is present. I’d appreciate help in understanding: **What subscription level(s)** are required for a HubSpot account to access workflows through the API ? **What specific user permissions** are needed for the connected user to successfully use the automation and workflows-access-public-api scopes? **Why does the API return a 403 Forbidden error even when the scope is present** in the access token — shouldn’t the presence of the scope imply the user has access? Any guidance would be greatly appreciated. Thanks in advance! ---
**Author:** ![Victor\_Becerra](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@Victor\_Becerra](https://community.hubspot.com/u/Victor_Becerra)\ **Post date:** [July 17, 2025, 1:25pm UTC](https://community.hubspot.com/t/403-forbidden-missing-workflows-access-public-api-scope-even-when-automation-scope-is-present/136386/2 "2025-07-17T13:25:18Z")
Hi @Shrinath Thank you for reaching out to the Community! I’d like to invite some community members who are subject matter experts to join this conversation. @coldrickjack @SteveHTM @GiantFocal - Would you be able to share any insights on this? Your expertise would be greatly appreciated. Best, Victor ---
**Author:** ![Shrinath](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@Shrinath](https://community.hubspot.com/u/Shrinath)\ **Post date:** [July 18, 2025, 9:42am UTC](https://community.hubspot.com/t/403-forbidden-missing-workflows-access-public-api-scope-even-when-automation-scope-is-present/136386/3 "2025-07-18T09:42:42Z")
I have created a test account of hubspot and connected my app, And Im not getting any 403 error. Does test account has required subscription? Which is missing in my clients account. Or How does it work? I request the Hubspot-Experts to guide me through this. Hoping for Response from Hubspot Community. Thank You. [@Victor\_Becerra](https://community.hubspot.com/t5/user/viewprofilepage/user-id/620965) @coldrickjack @SteveHTM @GiantFocal ---
**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\ **Post date:** [July 21, 2025, 8:53pm UTC](https://community.hubspot.com/t/403-forbidden-missing-workflows-access-public-api-scope-even-when-automation-scope-is-present/136386/4 "2025-07-21T20:53:49Z")
Hey @Shrinath 👋 For apps using a Public App for auth, the subscription level of the destination is what is significant for functionality. So if the clients don’t have access to Workflows, they won’t be able to use your app for anything to do with Workflows. App Test account have access to _most_ features, which is likely why you don’t get an error when installing there. — Jaycee