CRM Card Fetch URL - Authorization Options

Developer Support APIs & Integrations
1

I am working on a Hubspot application which I plan to make available to the public (therefore private CRM extensions (beta) are out).
I was planning to use CRM Cards to display information from my applications platform on the relevant page(s) in Hubspot, with actions which would make requests back to my platform.
I currently secure my platform via an API Key which must be passed in the header of the request - this is important for my platform to be able to ensure that we are sending the right information back. This is part of how I enforce logical data segregation in my multi-tenant platform.
I do not see any options to set a custom header in the CRM card data fetch. I also see in my developer environment that it seems like I can only provide a single endpoint URL which I’d need to apply to all tenants. This is fine if I can pass my API key, but doesn’t make much sense if I cannot.
Has anyone dealt with this issue before and have any workarounds?

2

Hi, @wdprice :waving_hand: Thanks for the interesting question. Let’s invite some of our community members to the converstaion — hey @Mike_Eastwood @louischausse @himanshurauthan have you solved for this issue, or considered a workaround, in any recent projects?

Best,

Jaycee

3

Forgot I even had this post out there until I got a notification about it.
Figured I’d share how I solved this. I ended up having to make a separate authentication layer for CRM cards using the Hubspot Portal ID. I first verify the request is authentic using the hubspot signature, then use the portalId in the request and compare it to the portalIds of integrated tenants (which I now persist during the integration setup) to verify the tenant it originated from. I then am able to set the context of the request to be scoped to that tenants data.
Hopefully this post helps someone else who is dealing with this in the future. I may it working now, but I still think it would be great to allow a bit more flexibility in the request structures for CRM cards. I’m basically forced to roll special code that applies only to Hubspot and not to other integrated platforms due to the inflexibility.