# conditionallyRequiredScopes not working for user **URL:** \ **Category:** Develop, Build & Integrate\ **Tags:** how-to\ **Created:** [June 22, 2026, 3:25pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028 "2026-06-22T15:25:52Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![MMcGarvey](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mmcgarvey/32/80871_2.png) [@MMcGarvey](https://community.hubspot.com/u/MMcGarvey)\ **Post date:** [June 22, 2026, 3:25pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/1 "2026-06-22T15:25:53Z")
Hello! Looking for some support if anyone has any thoughts. Our public app’s OAuth fails for one specific user with “an unexpected error occurred during the app authorization process” when requesting `conditionallyRequiredScopes` in the `scope` param, while it works fine for me when testing, so what would cause one user to fail authorization like this? ---
**Author:** ![chighsmith](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chighsmith](https://community.hubspot.com/u/chighsmith)\ **Post date:** [June 22, 2026, 6:33pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/3 "2026-06-22T18:33:17Z")
Hi @MMcGarvey, Thank you for posting to the Community! I’d like to tag in some of our Top Contributors to see if they have any suggestions on this one! Hi @KlemenHrovat @louischausse and @Mike_Eastwood have you all seen this behavior before? If so, how did you resolve it? Cassie, Community Manager ---
**Author:** ![Mike\_Eastwood](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mike_eastwood/32/70075_2.png) [@Mike\_Eastwood](https://community.hubspot.com/u/Mike_Eastwood)\ **Post date:** [June 22, 2026, 8:03pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/4 "2026-06-22T20:03:15Z")
Hi @MMcGarvey Are any of your `conditionallyRequiredScopes` tier dependent? If they rely on the installer having a feature e.g. `crm.objects.feedback_submissions.read` and they don’t have Service Hub Pro the install will fail. Typically a test Portal has all the hubs. Have fun Mike ---
**Author:** ![MMcGarvey](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mmcgarvey/32/80871_2.png) [@MMcGarvey](https://community.hubspot.com/u/MMcGarvey)\ **Post date:** [June 22, 2026, 8:06pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/5 "2026-06-22T20:06:59Z")
Thanks Mike, that’s the angle I’m most worried about, and the “test portal has all the hubs” point is well taken. Here’s our setup. Required: `tickets`, `oauth`. Conditionally required: `conversations.read`, `crm.objects.contacts.read`, `files.ui_hidden.read`, `crm.objects.owners.read`. Per the scopes reference, all four read as “Any account” with no tier requirement, so on paper none should be feature-gated. But two things make me want a second opinion: 1. The user it fails for is a **Super Admin** , and their portal clearly has a Conversations inbox (they have chat- and email-sourced tickets), so `conversations.read` should be grantable on that account. 2. A different customer granted `crm.objects.owners.read` and `crm.objects.contacts.read` with no problem, so the suspects narrow to `conversations.read` and/or `files.ui_hidden.read`. Do you know of either `conversations.read` or `files.ui_hidden.read` having a feature/tier dependency that isn’t reflected in the scopes table? That’s the gap I can’t close from my side. Appreciate it. ---
**Author:** ![MMcGarvey](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mmcgarvey/32/80871_2.png) [@MMcGarvey](https://community.hubspot.com/u/MMcGarvey)\ **Post date:** [June 22, 2026, 8:47pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/6 "2026-06-22T20:47:30Z")
cc: @Mike_Eastwood (Not sure if tagging is better, thank you) ---
**Author:** ![Mike\_Eastwood](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mike_eastwood/32/70075_2.png) [@Mike\_Eastwood](https://community.hubspot.com/u/Mike_Eastwood)\ **Post date:** [June 23, 2026, 8:03pm UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/7 "2026-06-23T20:03:49Z")
Hi @MMcGarvey Do you have a Developer Portal where you can spin up a Test Portal with the exact same tiers as the portal that fails? Then at least you can test without annoying your customer. I would try moving scopes around, to “requiredScopes”, or “optionalScopes” to see if that impacts the installation error you are seeing. Also, I would _try_ adding `files` your scopes. You’re welcome to send me a private message with your full OAuth URL to see if I can see anything unusual. -Mike p.s. I do **not** work for HubSpot so I cannot see anything from inside HubSpot, but I have wrestled with issues like this a lot over the last decade. p.p.s. yes, I need to get out more ---
**Author:** ![MMcGarvey](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mmcgarvey/32/80871_2.png) [@MMcGarvey](https://community.hubspot.com/u/MMcGarvey)\ **Post date:** [June 25, 2026, 4:49am UTC](https://community.hubspot.com/t/conditionallyrequiredscopes-not-working-for-user/151028/8 "2026-06-25T04:49:50Z")
Hey @Mike_Eastwood Thank you for the suggestions and everything else 🙂 I was able to get the issue resolved, it had to do with app-specific governance settings that the customer had to go through some settings from here: [Manage access to apps](https://knowledge.hubspot.com/integrations/manage-access-to-ai-connectors) Appreciate the support!