HubSpot OAuth token response not including scope

Developer Support APIs & Integrations
1

Hi all,

I’m implementing a HubSpot OAuth 2.0 flow using the /oauth/v1/token endpoint.

In the docs and some older examples, I see references to a scope field in the token response. However, in my current implementation, the token response only includes access_token, refresh_token, expires_in, token_type, etc. — there’s no scope field at all, or it’s coming back empty.

A few questions:

  1. Is scope still expected to be returned in the token response for new OAuth apps?
  2. Under what conditions might scope be omitted or empty?
  3. Is there a recommended way to confirm which scopes were actually granted at install time (other than relying on what I requested in the authorization URL)?

I’m just trying to understand if this is expected behavior or if I’m missing something in my request.

Thanks!

2

Hi @Sna919

Personally I use a second API call to Retrieve refresh token metadata which includes Scopes.

The Get Request:

https://api.hubapi.com/oauth/v1/refresh-tokens/{token}

Returns this reponse:

{
 "client_id": "<string>",
 "hub_id": 123,
 "scopes": [
 "<string>"
 ],
 "token": "<string>",
 "token_type": "<string>",
 "user_id": 123,
 "hub_domain": "<string>",
 "user": "<string>"
}

Have fun

Mike

Here to learn more about HubSpot and share my HubSpot Knowledge. I’m the founder of Webalite a Gold HubSpot Partner Agency based in Wellington, New Zealand and the founder of Portal-iQ the world’s first automated HubSpot Portal Audit that helps you work smarter with HubSpot.
Please note - this post has been updated to ensure it adheres to our Community Guidelines.

3

Hi @Sna919

Hey, what I generally do is provide all the scopes in the app while creating it, and add more scopes that are required, then I use the app id, Client Id, and Client secret to get the access token. This approach works for me and my public apps.

Thanks!