# New Developer platform and OAuth **URL:** \ **Category:** APIs & Integrations\ **Tags:** oauth\ **Created:** [September 19, 2025, 12:30am UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774 "2025-09-19T00:30:32Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![LDekester](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/ldekester/32/102437_2.png) [@LDekester](https://community.hubspot.com/u/LDekester)\ **Post date:** [September 19, 2025, 12:30am UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774/1 "2025-09-19T00:30:32Z")
Hi, I recently tried to migrate a Legacy App to the new Dev Platform. I created a new project and uploaded settings through the CLI that I thought were the same as my legacy one however I am having issues now. With the legacy system I had created a web app that would connect to Hubspot via the OAuth redirection system and each team member could connect to the app. The platform would enable them to perform certain task within Hubspot like create Tasks or update Tickets… and I could always know who was interfacing with Hubspot with the access-token via [https://api.hubapi.com/oauth/v1/access-tokens/{{access\_token}}](https://api.hubapi.com/oauth/v1/access-tokens/%7B%7Baccess_token%7D%7D) which would give me the email address attached to the token. However now with the new app I created under the development platform the access\_token email address doesn’t persists when the token is refreshed. What I noticed is that when the token refreshes the email address switches to the latest user that connected to the app. I assume it has something to do with the config of the new app, and here it is: { “uid”: “new-app”, “type”: “app”, “config”: { “description”: “”, “name”: “new-Application”, “distribution”: “marketplace”, “auth”: { “type”: “oauth”, “redirectUrls”: [ “[https://www.mydomain.com/hs-redirect](https://www.mydomain.com/hs-redirect)” ], “requiredScopes”: [ “oauth”, “tickets”, “crm.objects.owners.read” ], “optionalScopes”: [], “conditionallyRequiredScopes”: [] }, “permittedUrls”: { “fetch”: [ “[https://api.hubapi.com](https://api.hubapi.com)” ], “iframe”: [], “img”: [] } } } Hope someone can help. ---
**Author:** ![chighsmith](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@chighsmith](https://community.hubspot.com/u/chighsmith)\ **Post date:** [September 19, 2025, 5:55pm UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774/2 "2025-09-19T17:55:31Z")
Hi @LDekester, Thank you for posting to the Community! I’d like to tag in some of our Top Contributors to see if they are able to reproduce this behavior on their end as well. Hi @miljkovicmisa @louischausse and @ChrisoKlepke Are any of you all seeing the same as @LDekester? Cassie, Community Manager ---
**Author:** ![LDekester](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/ldekester/32/102437_2.png) [@LDekester](https://community.hubspot.com/u/LDekester)\ **Post date:** [September 19, 2025, 10:47pm UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774/3 "2025-09-19T22:47:46Z")
Thank you Cassie. To give more context I use the node js package “@hubspot/api-client”: “^13.2.0”, to get the access token and refresh token on redirection. Here is some pseudo code: `import hubspot from "@hubspot/api-client";const GRANT_TYPES = { AUTHORIZATION_CODE: 'authorization_code', REFRESH_TOKEN: 'refresh_token',};const hubspotClient = new hubspot.Client();export async function getHubspotAuthToken(request, reply) { const { code } = request.body; //On redirection from Hubspot the code is used //in the body a POST call if (code) { const { CLIENT_ID, CLIENT_SECRET, REDIRECT_URL } = process.env; try { const tokens = await hubspotClient.oauth.tokensApi.create( GRANT_TYPES.AUTHORIZATION_CODE, code, REDIRECT_URL, CLIENT_ID, CLIENT_SECRET ); return tokens } catch (e) { ... handle errors } } else { ... bad request missing code }}` I did some testing with 2 accounts. I connect with the first one and get an access\_token and refresh\_token. On another computer I connect with the 2nd account and I get an access\_token and the same refresh\_token. When using the refresh token on the first computer I then get an access token that is now tied to the 2nd account. With my legacy app that wouldn’t happen when using the refresh token I would get an access token still tied the same account. Hope this helps clarify my question. ---
**Author:** ![suprdense](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/suprdense/32/6496_2.png) [@suprdense](https://community.hubspot.com/u/suprdense)\ **Post date:** [September 23, 2025, 4:39am UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774/4 "2025-09-23T04:39:01Z")
Hey LDekester, Your refresh tokens are being overwritten, so every new login replaces the single refresh token you stored, subsequent refreshes return an access token tied to whoever last completed the OAuth flow. Fix: -Save tokens per installation (key by hubId) instead of a single global token. -Always overwrite the stored refresh\_token when HubSpot returns a new one. -Prevent concurrent refreshes for the same hubId (use a per-hub mutex/lock). -After any token exchange, call GET /oauth/v1/access-tokens/{access\_token} and store the returned hubId and user with the tokens. Store these fields per install: hub\_id, access\_token, refresh\_token, expires\_at, user\_email, updated\_at. Implement these rules and the issue should be solved. I hope this clears things up and provides the context you were looking for. If it answers your question, please consider marking it as the accepted solution and giving it an upvote to help other community members. ---
**Author:** ![LDekester](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/ldekester/32/102437_2.png) [@LDekester](https://community.hubspot.com/u/LDekester)\ **Post date:** [September 23, 2025, 5:00am UTC](https://community.hubspot.com/t/new-developer-platform-and-oauth/139774/5 "2025-09-23T05:00:45Z")
Hi suprdense, I think you misunderstand the situation. By multiple accounts I mean multiple users within the same hub\_id. I did some more testing and what I found out is that prior to moving to the new app, I would get one unique access token and one unique refresh token per user who conected through the OAuth flow. However with the new app I get one unique access token and one refresh token that is not unique. It is the same for all the subsequent users that log in. My code hasn’t changed besides the value of 2 variables: CLIENT\_ID and CLIENT\_SECRET. Which leads me to believe that it’s a configuration issue with the new App system but I can’t figure it out.