Clarifying Public vs. Private App Capabilities for Standardized Setup

Developer Support APIs & Integrations
1

Hi everyone,

I’m building an app to help us standardize client HubSpot portals, and I want to check if I’ve understood the split between public apps and private apps correctly.

My goal
We want to automate the initial setup of new client portals with a consistent schema. This includes:

  • Creating deals, contacts, companies, and tasks
  • Defining and editing custom properties on standard objects
  • Creating lists and list memberships
  • Creating views, email templates, and meetings
  • Eventually also managing deal stages/pipelines and custom objects

My current understanding

  • Public apps (via OAuth) → can handle everything currently exposed in the public app APIs:

    • Creating properties for standard objects (contacts, companies, deals)
    • Creating and managing records
    • Creating lists and memberships
    • Creating views, tasks, email templates, meetings

  • Private apps (per client) → still required for things not exposed to public apps, namely:

    • Creating pipelines and pipeline stages
    • Creating pipeline popups
    • Creating custom objects and schemas

Planned workflow

  1. Client installs the public app to get the “standard manifest” across their portal.

  2. For custom schemas and pipelines:

    • Either the client invites me temporarily as Super Admin, or
    • The client generates a one-time private app token with minimal scopes, I provision the custom schemas, and they revoke it afterward.

My questions

  1. Does my current understanding of what’s possible with public apps vs. private apps line up with how HubSpot works today?
  2. Are there any scopes I’m missing that would allow pipelines and custom objects to be handled in a public app (or is this strictly private app territory)?
  3. For debugging “insufficient scopes” errors — is there a good way to confirm whether the test account itself is limiting access, even with Super Admin + Enterprise Trial?

Any feedback or corrections would be greatly appreciated :folded_hands:

2

Just commenting here, so I can come back and get the expert opinions on this.

3

Hi @PBallerscheff

My suggestion would be to use the private app. Create a pvt app and provide all the required scopes to it, all the things that you have mentioned can be achieved using the pvt app. It will create an access token and you can use it to hit the API endpoints. Just make sure that your access token is not exposed; keep it private. In the pvt you have to add scopes that are mentioned in the API doc which you are trying to hit, just add those scope and use the token to hit. As you said, you are a superadmin, so you can create and add scopes to the instance.

I hope this will help you out. Please mark it as Solution Accepted and upvote to help another Community member.

Thanks!

4

Hey, friends :waving_hand: Make sure you check out the latest updates here about the brand-new HubSpot Developer Platform. And specifically for this post, the Create a new app using the CLI section will be very relevant for you @PBallerscheff. Talk soon! — Jaycee