We have read through the documentation and through many forum posts and it is NOT clear on how to mange scopes and updates.
We have also played with all the OAuth2 paths across many different accounts getting inconsistent results. We can’t determine what our path forward is.
Some accounts result in the following errors and some accounts don’t so it is hard to understand our path forward and we would like some calification.
“Couldn’t complete the connection - Insufficient scopes were provided. Please contact the app developer.”
What we have gathered is all the scopes on the applciation in hubspot need to also be included when installing the app (/oauth/authorize).
If the application contains 2 scopes but the `/oauth/authorize` call contains 1 scope you will recieve the error stated above. This is true but not in all cases. Some accounts worked and some other accounts did not. It looks to be related to if the account had already installed that applciation before or not (not 100% here).
Can we get some clarification here?
If the clarification is that all scopes on the applciation need to be included in the `/oauth/authorize` call then how would an applciation support the following:
- An applciation that might have an upgrade path that allows the user to use portions for free then after upgrade and re-athenticate (including more scopes)?
- An existing appliation, that has an install base, that needs to add an additional scope to add new functionality?
- With this limitation of having the applciation and the call to `/oauth/authorize` match on scopes applciation builders would have to time their applciation releases with the update to the applciations scopes.
Typical OAuth2 uses the following approach:
- If the OAuth2 application has 2 scopes (ScopeA, ScopeB) then the client applcaition can ask for just ScopeA or both ScopeA and ScopeB. If the client application asks for ScopeA, ScopeB, and ScopeC then ScopeC would either get ignored and only ScopeA and ScopeB would be granted or the `/oauth/authorize` would result in an error.
The above workflow allows the developer writting the client applcaition and managing the OAuth2 applcaition to roll out updates without having to syncronize them.
Can we get some clarification here as well?
We are trying to make some updates to our existing application and the lack of documenation as well as the inconsistent results is causing us to not move forward with this udpates with fear of breaking our customer base.
I appreciate you taking the time to add your thoughts and frustrations. I am going to add my thoughts + tag a few of our community members to share their experiences with getting apps up and running. You also have the ability to set scopes as `optional`. This can eliminate scopes errors when your app is installed on portals without the requested scope(s).