# Not authorized to access application

**URL:** <https://community.hubspot.com/t/not-authorized-to-access-application/17435>\
**Category:** APIs & Integrations\
**Tags:** timeline-and-extensions-apis\
**Created:** [November 26, 2019, 10:13pm UTC](https://community.hubspot.com/t/not-authorized-to-access-application/17435 "2019-11-26T22:13:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mstralka](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mstralka/32/35926_2.png) [@mstralka](https://community.hubspot.com/u/mstralka)\
**Post date:** [November 26, 2019, 10:13pm UTC](https://community.hubspot.com/t/not-authorized-to-access-application/17435/1 "2019-11-26T22:13:29Z")

</div>

I built an application months ago that creates several custom Timeline Event Types and then a user of our app can create custom Timeline Events of those Types on a Contact.

So far we’ve only used it with our own HubSpot Trial account but we are ready to publish it to the Marketplace.

We tested it in our own Test Account and everything worked fine.

My app uses OAuth to authenticate and has these scopes:

- contacts
- timeline
- oauth

I’m not sure what changed or when, but now when I try to [Get Timeline Event Types](https://developers.hubspot.com/docs/methods/timeline/get-event-types)using my OAuth-authenticated account (which is a Super User), I get this 403 Forbidden exception:

`Account '6787334' is not authorized to access Application '205036'`

But I used OAuth to permit Application 205036 in account 6787334 as shown in this screenshot:

> **[TechSmith Screencast](https://app.screencast.com/)**
>
> World's leading screen capture + recorder from Snagit + Screencast by Techsmith. Capture, edit and share professional-quality content seamlessly.

If I use the hapikey instead of the OAuth access token, it works fine.

I’ve never had to use the hapikey before, and understand that the [use of API Keys is discouraged](https://developers.hubspot.com/docs/methods/auth/oauth-overview).

Does anyone know why an OAuth access token would stop working for Timeline Event Type-related API calls?

---

<div class="post-metadata">

**Author:** ![WendyGoh](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/wendygoh/32/42320_2.png) [@WendyGoh](https://community.hubspot.com/u/WendyGoh)\
**Post date:** [November 28, 2019, 6:56am UTC](https://community.hubspot.com/t/not-authorized-to-access-application/17435/2 "2019-11-28T06:56:05Z")

</div>

Hi ,

When using this endpoint [Get Timeline Event Types](https://developers.hubspot.com/docs/methods/timeline/get-event-types), it is the intended and documented behavior that you should work only with a **developer hapikey**.

The reason it was working before which should not have been working, was an unintended behavior.

As timeline event is attached to a dev portal, we would need to use the **developer hapikey** instead of OAuth authentication.

---

<div class="post-metadata">

**Author:** ![advance512](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/advance512/32/34870_2.png) [@advance512](https://community.hubspot.com/u/advance512)\
**Post date:** [April 30, 2020, 8:54pm UTC](https://community.hubspot.com/t/not-authorized-to-access-application/17435/3 "2020-04-30T20:54:19Z")

</div>

Why would you need the API key of the Developer to create timeline events in the Target Portal? After all, you already have the user OAuth authorized, you have the refresh token. Why is the API key even necessary?