Hi,
I recently tried to migrate a Legacy App to the new Dev Platform. I created a new project and uploaded settings through the CLI that I thought were the same as my legacy one however I am having issues now.
With the legacy system I had created a web app that would connect to Hubspot via the OAuth redirection system and each team member could connect to the app. The platform would enable them to perform certain task within Hubspot like create Tasks or update Tickets… and I could always know who was interfacing with Hubspot with the access-token via https://api.hubapi.com/oauth/v1/access-tokens/{{access_token}} which would give me the email address attached to the token.
However now with the new app I created under the development platform the access_token email address doesn’t persists when the token is refreshed. What I noticed is that when the token refreshes the email address switches to the latest user that connected to the app.
I assume it has something to do with the config of the new app, and here it is:
{
“uid”: “new-app”,
“type”: “app”,
“config”: {
“description”: “”,
“name”: “new-Application”,
“distribution”: “marketplace”,
“auth”: {
“type”: “oauth”,
“redirectUrls”: [
“https://www.mydomain.com/hs-redirect”
],
“requiredScopes”: [
“oauth”,
“tickets”,
“crm.objects.owners.read”
],
“optionalScopes”: [],
“conditionallyRequiredScopes”: []
},
“permittedUrls”: {
“fetch”: [
“https://api.hubapi.com”
],
“iframe”: [],
“img”: []
}
}
}
Hope someone can help.
Hi @LDekester,
Thank you for posting to the Community!
I’d like to tag in some of our Top Contributors to see if they are able to reproduce this behavior on their end as well.
Hi @miljkovicmisa @louischausse and @ChrisoKlepke Are any of you all seeing the same as @LDekester?
Cassie, Community Manager
Thank you Cassie.
To give more context I use the node js package “@hubspot/api-client”: “^13.2.0”, to get the access token and refresh token on redirection.
Here is some pseudo code:
import hubspot from "@hubspot/api-client";const GRANT_TYPES = { AUTHORIZATION_CODE: 'authorization_code', REFRESH_TOKEN: 'refresh_token',};const hubspotClient = new hubspot.Client();export async function getHubspotAuthToken(request, reply) { const { code } = request.body; //On redirection from Hubspot the code is used //in the body a POST call if (code) { const { CLIENT_ID, CLIENT_SECRET, REDIRECT_URL } = process.env; try { const tokens = await hubspotClient.oauth.tokensApi.create( GRANT_TYPES.AUTHORIZATION_CODE, code, REDIRECT_URL, CLIENT_ID, CLIENT_SECRET ); return tokens } catch (e) { ... handle errors } } else { ... bad request missing code }}
I did some testing with 2 accounts.
I connect with the first one and get an access_token and refresh_token. On another computer I connect with the 2nd account and I get an access_token and the same refresh_token.
When using the refresh token on the first computer I then get an access token that is now tied to the 2nd account.
With my legacy app that wouldn’t happen when using the refresh token I would get an access token still tied the same account.
Hope this helps clarify my question.
Hey LDekester,
Your refresh tokens are being overwritten, so every new login replaces the single refresh token you stored, subsequent refreshes return an access token tied to whoever last completed the OAuth flow.
Fix:
-Save tokens per installation (key by hubId) instead of a single global token.
-Always overwrite the stored refresh_token when HubSpot returns a new one.
-Prevent concurrent refreshes for the same hubId (use a per-hub mutex/lock).
-After any token exchange, call GET /oauth/v1/access-tokens/{access_token} and store the returned hubId and user with the tokens.
Store these fields per install: hub_id, access_token, refresh_token, expires_at, user_email, updated_at.
Implement these rules and the issue should be solved.
I hope this clears things up and provides the context you were looking for. If it answers your question, please consider marking it as the accepted solution and giving it an upvote to help other community members.
Hi suprdense,
I think you misunderstand the situation. By multiple accounts I mean multiple users within the same hub_id.
I did some more testing and what I found out is that prior to moving to the new app, I would get one unique access token and one unique refresh token per user who conected through the OAuth flow. However with the new app I get one unique access token and one refresh token that is not unique. It is the same for all the subsequent users that log in.
My code hasn’t changed besides the value of 2 variables: CLIENT_ID and CLIENT_SECRET.
Which leads me to believe that it’s a configuration issue with the new App system but I can’t figure it out.