Hi @JRobinson81,
totally get the confusion here.
Two things are overlapping here: where to create the credential, and how to trigger on “new company.”
Creating the credential: In your production HubSpot account, go to your app settings and create a static auth app. Assign scopes such as crm.objects.companies.read and, if you plan to write back, crm.objects.companies.write. Then, in n8n, use an HTTP Request node with the header Authorization: Bearer YOUR_TOKEN to call the CRM v3 endpoints.
If you’re already using a legacy private app, the token and header mechanics work the same way, you’d create it under Settings > Integrations > Private Apps in your account. See Legacy private apps for that path if needed.
Sanity check: When you created the token, confirm you were in your intended production account (via the account selector), not a developer test account, using the wrong account is a common source of “insufficient scopes” errors.
Triggering on new companies: If webhooks aren’t available to you, a polling pattern works as a fallback: call the Search API for companies created since your last run, sorted by createdAt, store the latest timestamp in n8n, and re-query periodically, processing only new records.
If workflow-triggered webhooks are available on your plan, firing a workflow on company creation to hit your n8n webhook avoids polling entirely.
If you see “insufficient scopes”: check that the token was created in the correct account, that scopes include crm.objects.companies.read, and that the n8n node is actually using the Bearer token you generated (not a different auth method). Testing with a plain HTTP node in n8n lets you see the raw error body from HubSpot.
Moderator Note: this post was reviewed for relevancy and optimized for clarity on August 28, 2026. Thank you for your contributions to the HubSpot Community!