Developer Projects OAuth never redirects after consent (Marketplace App)

Developer Support APIs & Integrations
1

Hi everyone,

I’m hoping someone from the HubSpot Developer team can help.

We’re building a Marketplace OAuth app using the new Developer Projects platform.

We’ve verified:

  • Client ID and Client Secret are correct.
  • Redirect URI is correctly registered.
  • Required scopes match exactly.
  • Build #3 is deployed.
  • OAuth URL is correctly formatted.

The OAuth flow reaches:

  • Account selection
  • Unverified app warning
  • Permission consent
  • “I accept the risk” confirmation

However, after consent, HubSpot never redirects to our callback URL. Our server receives no callback at all (no authorization code and no error).

As a control test, we intentionally requested only three scopes, and HubSpot correctly rejected the request by identifying the two missing scopes. This confirms HubSpot is reading the current deployed app configuration.

Has anyone experienced this with Developer Projects, or is there anything else we should check before opening a support case?

App ID: 45281200

Thank you!

2

1. Prove whether HubSpot is redirecting at all. Open browser DevTools → Network tab (with “Preserve log” enabled) before clicking “Connect app.” After consent, look for a 302 from HubSpot. Three outcomes:

  • No 302 at all, request to HubSpot returns 200/blank or hangs → HubSpot-side failure; capture the HAR file and the x-hubspot-correlation-id response header — that’s exactly what support needs.
  • 302 issued but to an unexpected URL → config/propagation mismatch.
  • 302 issued to your URL but your server sees nothing → the problem is between browser and your server (DNS, TLS cert, firewall, proxy stripping the request). Test this by swapping in a neutral endpoint (see #2).

2. Swap the redirect URI for a webhook.site (or ngrok) URL temporarily. Register it in app-hsmeta.json, redeploy, and run the flow. If webhook.site receives the code, your app config is fine and the issue is your infrastructure. If even webhook.site gets nothing, it’s HubSpot-side.

3. Check redirect URL exactness in the deployed build. With Developer Projects, redirect URLs live in the auth configuration of app-hsmeta.json and must match the backend OAuth server exactly. Trailing slash, www. vs bare domain, port numbers, and casing all matter. Note that even a trailing-slash difference has caused HubSpot to fall back to unexpected redirect behavior in the new install flows. Also confirm build #3 is actually the deployed build, not just uploaded — your scope-rejection control test suggests it is, but scopes and redirect URLs can propagate separately; there have been caching/propagation issues on HubSpot’s side with newly deployed configs, so try waiting ~15 minutes or bumping a new build. Projects App Guide + 2

4. Try a different install context. Test with a Super Admin user in a fresh incognito window (already logged into HubSpot first — there are known bugs when the OAuth flow passes through the login screen). Also try a different test/developer account: marketplace-distribution apps that aren’t yet listed sometimes behave differently outside developer test portals. HubSpot

5. Check the state parameter and URL encoding. A malformed state or unencoded characters in the redirect_uri query param can cause silent drops. Try the barest possible authorize URL (client_id, redirect_uri, scope only).

If #1 shows HubSpot never issues the redirect and webhook.site confirms it, open the support case with: the HAR file, correlation ID, project/app ID, build number, timestamp, and portal ID of the install attempt — and reference that the scope-validation control test proves the deployed config is being read. That evidence will get it routed to the Developer Projects team quickly rather than bounced back with generic OAuth docs.

3

Hi @mrrodger and welcome, it’s a pleasure to have you here!

Thanks for reaching out to the HubSpot Community!

To add to what @AbhitheRevOpsGuy shared (thank you!), here are some suggestions:

  • Since you’re on Developer Projects, you have access to the OAuth logs tab in developer monitoring. Go to Development > Monitoring > Logs in your HubSpot account.

If HubSpot’s backend logged an AUTHORIZATION_GRANT, the redirect was issued, the problem is on the browser/network path. If there’s no AUTHORIZATION_GRANT, the consent didn’t actually complete on HubSpot’s side.

  • If you are using Safari, this is a know behavior where Safari’s privacy setting strips query parameters from window.location.search after cross-site redirects.

For that you can test in Chrome/Firefox to rule this out immediately.

If Safari is the culprit, the workaround is to disable “Use advanced tracking and fingerprinting protection” (Safari → Settings → Privacy).

  • Even though you’ve verified the redirect URI is registered, can you please confirm the redirect_uri parameter in your OAuth URL exactly matches (including trailing slash, http vs https, port) what’s in your deployed app-hsmeta.json redirectUrls array.

A mismatch won’t always produce a visible error, it can cause the flow to stall after consent.

I’d love to hear from our Top Experts: Hi @zach_threadint and @Anton do you have additional suggestions to help @mrrodger, please?

Thanks so much and wishing you a lovely day!
Bérangère

This post was created with the assistance of AI tools