# Add sensitive scope to working application

**URL:** <https://community.hubspot.com/t/add-sensitive-scope-to-working-application/116288>\
**Category:** APIs & Integrations\
**Tags:** oauth\
**Created:** [September 13, 2024, 2:32am UTC](https://community.hubspot.com/t/add-sensitive-scope-to-working-application/116288 "2024-09-13T02:32:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![TDDEV](https://avatars.discourse-cdn.com/v4/letter/t/67e7ee/32.png) [@TDDEV](https://community.hubspot.com/u/TDDEV)\
**Post date:** [September 13, 2024, 2:32am UTC](https://community.hubspot.com/t/add-sensitive-scope-to-working-application/116288/1 "2024-09-13T02:32:17Z")

</div>

Hi Support Team,

I have an application that work well. Now we want to add new sensitive scope to this one (crm.lists.write) to support new feature.

I understand that if the user would like to use new feature which APIs called required new scopes then they need to create new authentications.

But I also would like to know if issued refresh\_token/access\_token would still work as-is if the APIs called don’t require new scopes. To check the possible impact to the current users with their stored authentications before adding new scope.

Thank you.

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [September 13, 2024, 3:42pm UTC](https://community.hubspot.com/t/add-sensitive-scope-to-working-application/116288/2 "2024-09-13T15:42:11Z")

</div>

Hey, @TDDEV 👋 You should be able to test this using your [Developer Test Account](https://developers.hubspot.com/docs/api/account-types#app-developer-accounts) which allows you to create up to 10 App Test Accounts. You could install your app in one before you update the scopes and then install again in another test account using the updated scopes.

Based on my understating:

- Existing users retain full access to existing features without changes
- Users utilizing the new feature will need to authorize the additional crm.lists.write scope
- Authentication tokens for existing functionalities remain unaffected

Have fun testing! — Jaycee

---

<div class="post-metadata">

**Author:** ![GRajput](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/grajput/32/102020_2.png) [@GRajput](https://community.hubspot.com/u/GRajput)\
**Post date:** [September 16, 2024, 7:12am UTC](https://community.hubspot.com/t/add-sensitive-scope-to-working-application/116288/3 "2024-09-16T07:12:10Z")

</div>

Hi @TDDEV

What you can do here is add new scopes to the app and then test it on stage with your testing account. If you change the scopes then the user need to reinstall the app again to use all the features.

I hope this will help you out. Please mark it as **Solution Accepted and upvote** to help another Community member.  
Thanks!