Heroku Hosted Apps (Node.JS & Express.JS)

Developer Support APIs & Integrations
1

I’ve been battling for a couple of days now trying to succesfully verify a small app I have built using the HubSpot OAuth Node.JS example.

The app is built in Node.JS using Express.JS and is hosted on Heroku.
The redirect address routes back to /oathcallback (as the HubSpot example suggests) and uses a ${PORT} variable stored in my .env file.

const REDIRECT_URI = http://localhost:${PORT}/oauth-callback;

The problem seems to lie with Heroku changing the PORT value everytime the app is deployed.

This leads the install to error because the Redirect URI’s no longer match.
I was just wondering if anyone had run into similar problems or if anyone has managed to find a work around.

Or, is it just that I’m doing something ridiculously stupid?
(Probably the most likely option)

Thanks in advance,
Danny.

2

Hey @DRG

Saw this post on stack overflow which you probably already saw…

@EduardoServilia or @zaklein might be able to help here

3

Thanks @dennisedson ,

You’re correct though, I did see that, amoungst a few other similar posts.
Not a great deal of help on the topic out there which surprises me a little, as I’m sure others must have been caught out.
Anyway, I actually found a work around late this afternoon; hopefully this will help anyone else who stumbles across this post.
I ended up hardcoding the Redirect URI as the URL address (without port) that Heroku gives your application.
For example:

https:// your-app-name.herokuapp.com/oauth-callback

It seems to be working for the time being.
However, I’ll report back if there are any hiccups.
Thanks again for trying to help.
Danny.

4

Hi @DRG ,
HubSpot app accepts with secure domain only, use only SSL certified domain.
https:// your-app-name.herokuapp.com/oauth-callback
Hope this helps!
Regards.

5

@DRG , the issue you hit with Heroku changing ports is very common.

In 2025, the right way is to stop relying on ${PORT} in your redirect and instead register the fixed HTTPS Heroku domain HubSpot assigns to your app (for example https://your-app-name.herokuapp.com/oauth-callback)

HubSpot’s OAuth flow validates against the exact redirect URI you configure, and it won’t accept localhost or dynamic ports (Working with OAuth - HubSpot docs )

If you’re testing both locally and in production, you can add multiple redirect URIs in your developer app settings HubSpot allows this, so you can safely switch between http://localhost:3000/oauth-callback and your live domain (Working with OAuth | OAuth Quickstart Guide - HubSpot docs )

The deeper pain here isn’t just the redirect mismatch. it’s how brittle these hand-rolled setups become once you try to scale. Every deploy means updating URIs, managing token refresh, retry logic, and keeping data consistent between HubSpot and your database.

That’s where most teams eventually burn time. Instead of gluing together workarounds, Stacksync eliminates this entire category of fragility. It maintains OAuth sessions automatically, syncs HubSpot data in both directions in real time, and handles the “dirty plumbing” like token rotation, error retries, and SSL enforcement for you. In practice, that means you focus on your Node/Express features, while Stacksync keeps HubSpot and your backend perfectly in step without the late-night debugging you’re living through now.