conditionallyRequiredScopes not working for user

Developer Support
1

Hello! Looking for some support if anyone has any thoughts.

Our public app’s OAuth fails for one specific user with “an unexpected error occurred during the app authorization process” when requesting conditionallyRequiredScopes in the scope param, while it works fine for me when testing, so what would cause one user to fail authorization like this?

3

Hi @MMcGarvey,

Thank you for posting to the Community! I’d like to tag in some of our Top Contributors to see if they have any suggestions on this one!

Hi @KlemenHrovat @louischausse and @Mike_Eastwood have you all seen this behavior before? If so, how did you resolve it?

Cassie, Community Manager

4

Hi @MMcGarvey

Are any of your conditionallyRequiredScopes tier dependent? If they rely on the installer having a feature e.g. crm.objects.feedback_submissions.read and they don’t have Service Hub Pro the install will fail. Typically a test Portal has all the hubs.

Have fun
Mike

5

Thanks Mike, that’s the angle I’m most worried about, and the “test portal has all the hubs” point is well taken.

Here’s our setup. Required: tickets, oauth. Conditionally required: conversations.read, crm.objects.contacts.read, files.ui_hidden.read, crm.objects.owners.read.

Per the scopes reference, all four read as “Any account” with no tier requirement, so on paper none should be feature-gated. But two things make me want a second opinion:

  1. The user it fails for is a Super Admin, and their portal clearly has a Conversations inbox (they have chat- and email-sourced tickets), so conversations.read should be grantable on that account.
  2. A different customer granted crm.objects.owners.read and crm.objects.contacts.read with no problem, so the suspects narrow to conversations.read and/or files.ui_hidden.read.

Do you know of either conversations.read or files.ui_hidden.read having a feature/tier dependency that isn’t reflected in the scopes table? That’s the gap I can’t close from my side. Appreciate it.

6

cc: @Mike_Eastwood (Not sure if tagging is better, thank you)

7

Hi @MMcGarvey

Do you have a Developer Portal where you can spin up a Test Portal with the exact same tiers as the portal that fails? Then at least you can test without annoying your customer.

I would try moving scopes around, to “requiredScopes”, or “optionalScopes” to see if that impacts the installation error you are seeing.

Also, I would try adding files your scopes.

You’re welcome to send me a private message with your full OAuth URL to see if I can see anything unusual.

-Mike

p.s. I do not work for HubSpot so I cannot see anything from inside HubSpot, but I have wrestled with issues like this a lot over the last decade.

p.p.s. yes, I need to get out more

8

Hey @Mike_Eastwood

Thank you for the suggestions and everything else :slight_smile:

I was able to get the issue resolved, it had to do with app-specific governance settings that the customer had to go through some settings from here: Manage access to apps

Appreciate the support!