App Cards connection to Third Parties: How to differentiate between accounts in HubSpot

Develop, Build & Integrate APIs & Integrations
1

Hey! I’m right now researching how to use the new and exciting App Cards feature with UI Extensions! I have just one question: If these App Cards are supposed to connect to our Third Party App Service, how does our service differentiate between different Hubspot clients? As far as I can tell, the only authorization for third-party calls is the SECRET that you pass in, which is the same across all users of the App Card. So if we have Ray’s Taxodermy and John’s Law Firm both using our App Card, how do we make sure Ray doesn’t intercept John’s info?

2

Hi, @Connor777 :waving_hand: Thanks for the great question. I’d like to invite some of our brilliant community members to the conversation — hey @Teun @zach_threadint @Mike_Eastwood do you have any insight into what @Connor777 is asking?

Thank you very much for taking a look! — Jaycee

3

Hi @Connor777 :waving_hand:

When a HubSpot User loads a UI Extension App Card, HubSpot supplies the given app developer a “context” data object that can be referenced within the given App Card’s .jsx file. For example, the “context” object might look something like this:

{
 "crm": {
 "objectId": 123456789,
 "objectTypeId": "0-1"
 },
 "location": "crm.record.sidebar",
 "user": {
 "id": 123456,
 "emails": [
 "example@example.com"
 ],
 "email": "example@example.com",
 "firstName": "Example",
 "lastName": "User",
 "roles": [],
 "teams": [],
 "locale": "en-au"
 },
 "portal": {
 "id": 987654321,
 "timezone": "US/Eastern"
 }
}

Within this example “context” object, the HubSpot Portal ID from which the given HubSpot User is loading the UI Extension App Card is 987654321. It’s then up to the app developer to authenticate against the correct HubSpot Portal, likely using previously stored OAuth credentials (see HubSpot’s OAuth API docs).

I hope that proves helpful. Please let me know if you have any follow-up questions.

4

It sounds like PortalId-connection would have to be done in combination with verification using the secret you can pass into UI-Extensions. Thanks!