Hi,
I am building a custom workflow action. when trigger happens it should hit my action url configured with the workflow payload. I need to implement oauth here with third party and use the access token in the hreader to hit the action url. can anyone help me with this. And i could see this is already implemented in Slack and Googlesheet action. When user open the action it initiates the oauth how can i do this.
Thanks in advance
Hi there @SurveySparrow
Thank you for posting!
I want to share a Community thread that helps with your issue:
There’s also a KB article that offers more help: Build custom workflow actions - HubSpot docs
Finally, I want to tag a few community experts to help us out: hey there @GRajput @HubSpot_Corey @BrandonWoodruff, any thoughts here?
Thanks!
Victor
Hi, what you’re describing is two separate pieces that work together: the OAuth authorization flow that happens when a user configures the action, and the actual execution call that fires with the token when a workflow triggers
For the OAuth piece, this lives in your app’s `app-hsmeta.json` configuration under the `auth` property. You define your redirect URLs, required scopes, and the OAuth type there. When a user installs your app or configures the workflow action, HubSpot handles the OAuth redirect and sends back an authorization code to your redirect URL. Your backend exchanges that for an access token and refresh token, and you store those server side mapped to the portal ID (App configuration - HubSpot docs).
The execution side is separat
When the workflow fires, HubSpot POSTs to your `actionUrl` with the workflow payload including the portal ID and object data. Your server receives that request, looks up the stored OAuth token for that portal, and then makes the outbound call to the third party service with the token in the Authorization header. HubSpot doesn’t forward third party tokens for you automatically, your middleware handles that mapping. The Slack and Google Sheets actions work the same way under the hood, they just have their own backend that stores the OAuth credentials per account and injects them at execution time
One thing that trips people up: the `actionUrl` endpoint receives the HubSpot request with HubSpot’s own authentication (verify the `X-HubSpot-Signature` header), and then your code separately authenticates outbound to the third party. These are two independent auth layers. If you need the user to authorize the third party connection before they can use the action, you handle that in your app’s onboarding flow or settings page, not inside the workflow action UI itself. I’ve worked through similar patterns connecting external services to HubSpot environments at Stacksync and the token storage plus portal mapping step is usually the part that needs the most attention
Hope this helps.