In our app we are requesting the following scopes: contacts timeline oauth.
When a super admin goes through the OAuth 2.0 flow to authorize our app, everything works as expected.
However, when a non-super admin goes through the OAuth 2.0 flow, we get an error saying that they do not have permission to do so. Reading the linked help doc seems to suggest they need super-admin access in order to be able to authorize the app.
In our app, we need not only an admin to install the app, but we need end users to authenticate so we can pull information on their behalf from HubSpot contacts, companies, and deals when rendering that information in our app.
How do we enable this without requiring the end users to be super admins in HubSpot? Is it a certain subset of the scopes (contacts timeline oauth) that require super admin? Will putting that subset of scopes as optional scopes solve this issue?
I was able to isolate the issue to specifically the contacts scope. What user permissions are required to grant access to an app that requires the contacts scope? Does the user need to be superadmin or is there are less powerful set of permissions that allows them to grant contacts access?
Generally speaking, an admin should be able to connect an application requesting the contacts scope if they have full access to all contact, company, and deal objects, per the definition in this article. This means they should have the following permissions in the Users & Teams section of your account settings:
I say “generally speaking” because permissions can be a bit more complex and there isn’t always a 1:1 relationship to settings and toggles in the UI.
To fully diagnose the issue, I’ll need to know the following:
Your app’s ID.
The Hub ID of the account where you wish to install your app.
The email or userId of the user completing the installation flow. (If you don’t want to spell out their entire email here, please specify their name or whatever comes before the @ symbol.)
Finally, you mention that “We need end users to authenticate so we can pull information on their behalf from HubSpot contacts, companies, and deals when rendering that information in our app.” This is not the intention of the OAuth flow described here, nor is it possible.
The existing OAuth system is not designed to act as a user-level auth process, nor is it intended to provide an authentication system for an external app. The system is intended to allow a single user to approve an app for an entire account.
Thus, if you want to surface data on contacts, companies, and deals to users in your external app, you must use your own authentication process before making API calls to your server and then to HubSpot (as most HubSpot APIs do not support CORS requests).
Is the issue that @Derek_Gervais mentions with the contacts scope requiring Super Admins for Marketing/CRM Free Portals still an ongoing issue? That seems to be what I’m experiencing, but his post is back from August last year, so wasn’t sure if that was ongoing or resolved.
So I understand that the idea is to have a super admin approve the application and to re-use their access token on behalf of all users in their portal, but when a user is using our application and we want to make a request to a HubSpot API on their behalf, how do we know which portal they are part of and which access token to use unless we have them oauth to HubSpot to at least get their portal id so we can match it with the super admin’s portal and access token?
I just found out that the issue Derek mentioned is still open. I won’t bore you with the details, but we dropped the ball on our end
Apologies.
Could you share the information I asked for above so I can notify the team that you’re also likely affected? Here it is again:
Your app’s ID.
The Hub ID of the account where you wish to install your app.
The email or userId of the user completing the installation flow. (If you don’t want to spell out their entire email here, please specify their name or whatever comes before the @ symbol.)
To best answer your last question, I’ll need a bit more context. Could you describe the nature of your application in more detail? Specifically, I want to know exactly what you mean by “make a request to a HubSpot API on their behalf.” Are these users logging into an instance of your application and adding to and pulling information from their HubSpot production account, or your own?
So we’ve created an integration with our app, Notejoy, a collaborative note-taking application. Within HubSpot it adds a Notes card via a CRM Extension that lets you create, attach, view, and collaboratively edit notes within HubSpot. Authentication works fine in this case with just the original Super Admin authenticating for showing the card and we use our own cookie-based authentication for Notejoy when showing various iframes.
The issue comes in with the integration within Notejoy itself, where we have introduced a HubSpot Sidebar that allows our users to edit Hubspot contact, company, and deal details directly from Notejoy. While the Super Admin may have already connected via OAuth, the challenge is when a team member comes to Notejoy and tries to view and edit HubSpot contact/companies/deals, we do not no which HubSpot portal they belong to and therefore don’t know which Super Admin access token to use, unless we have them also OAuth with HubSpot to at least get their portal id so we can identify which Super Admin access token that we have stored that we should be using. So in that case we have to use the OAuth API as an end-user OAuth API to just understand what team the end user is part of. Is there any alternative approach to this?
Ada does have all the correct permissions in the UI to authenticate an app requiring the contacts scope, so I will share this information with the team. Hopefully, we’ll get this issue resolved once and for all in the near future.
Thanks so much for the context! As we discussed, it’s not possible for end-users to use the OAuth flow in that way, but I have an idea:
What if you asked for the user’s Hub ID and checked their Notejoy login email against the users in that HubSpot account via the Owners API? Both this and thisGet information endpoint return a hub_id value, so looking up a stored OAuth access token should be easy enough. Cross-referencing the email would add another layer of security. If a user doesn’t know their Hub ID, you can link to this resource.
Thanks for following up. @felipeecst. Apologies for the pain around this.
This issue is caused by the fact that non-super admins in free accounts currently cannot get access to a necessary scope within the contacts scope group.
We plan to release a change to all free accounts that will resolve this issue around the first week of April, 2019. Until then, super admins will still be the only user role able to connect OAuth apps requesting the contacts scope group to free accounts.
I’ll update here when the relevant features are live with additional instructions. Thanks for your patience and understanding.
I am trying to authorize the application in a non-free HubSpot account. The account is under Marketing Hub Professional and Sales Hub Professional plan.
So, per your description of the problem, this should not be happening, right?
It looks like you reached out to support and are working with Gabriel.
My colleague Connor is assisting Gabriel on our end. From what I gather, it appears that the issue is that Vinicius’ user does not have lists access (In user settings: Marketing > Lists).
If this is the case, this is actually the same cause as discussed above. The only difference is that you can grant access to lists in the UI while free users cannot.
Does all of this mean that there is no account level authentication needed (or possible) via Hubspot for external apps? I’ve got an Alexa app working through my hapiKey right at the moment, but I was planning on making it available to our sales team with the notion they’d be using their individual accounts with it. I’m having a **bleep** of a time with account linking in the development version of the app that wwould use it rather than the ahpiKey and I’d sort of like to know if I am barking up the wrong tree.
Is it possible for an individual user within our account to link his or her account to the Alexa app?
Apologies for the delayed response. I have been out of the office. I’d be happy to clarify further.
It sounds like you’re describing user-specific integrations or at least user-specific instances of an integration. This is not yet possible with HubSpot’s authentication methods.
A single super admin or user with the proper permissions (scopes) connects an integration which can then be used by all account users with the connecting user’s credentials.
In your case, all users would have to use the Alexa account of the super admin or user who connected the app.
I’m truly sorry if this is painful news. We are moving toward user-specific integrations, but I don’t have a concrete timeline to share at this time.
Any updates on this? We would really like to be able to use oAuth per user instead of a single Super Admin account, but because this issue with fetching contacts, we can’t.
Is there any way of bypassing this issue for free tier customers? Our app will only ever fetch contacts, i.e. never create or update them if that’s of any help.
To clarify, by “We would really like to be able to use OAuth per user,” are you referring to user-specific integrations?
If so, these are still not supported. While we hope to support user-specific apps at some point, I cannot offer a concrete timeline.
The issue of non-Super Admins in Marketing or Sales Hub Free accounts failing to connect apps requiring the contacts scope is ongoing. At this time, there is no way to bypass the issue — a Super Admin must connect the integration.
I have reached out to the relevant team to stress the urgency of this issue. Thank you for your continued patience.
On July 10 2019 you mentioned “The issue of non-Super Admins in Marketing or Sales Hub Free accounts failing to connect apps requiring the contacts scope is ongoing. At this time, there is no way to bypass the issue — a Super Admin must connect the integration.”
Is this still the case? We seem to be experiencing the exact same issue with our integration here in Feb 2021.
I just tested this again. This time, I was able to connect an app requiring the contacts scope with a HubSpot Free account with a non-Super Admin user. See the screenshots below:
If you’re seeing different behavior, could you confirm the Hub ID and app ID you are using along with the first five characters of the user’s email (or the user ID if you have that handy)?
I was just testing the integration of our app with Hubspot, but I’m experiencing those issues when trying to connect with a non-super admin user (user does not have permissions to authorize scopes).
For super admins it works just fine. Also, we haven’t had any negative feedback from customers yet, so I feel this could be related to our free testing instance?
Hi Isaac,
Hope you are doing well.
Just want to as a clarificationh here regarding the Oauth flow for non admin users.
So once a super admin installs and accepts the integration the other non admin users should be able to complete Oauth as well, or it is not how it works?
In other words, after the app is approved by super admin, how to make non-admin users use it? Simply use the refresh token generated from Oauth from the admin?
In other words, the generated token to be used in API should be shared accross all users who wants to use it or the access token should be generated for each non admin user?
Really appreciate your help.
Kind Regards,
Once a Super Admin (or other user with the proper role) connects an integration, it can be used by all users in the account, provided they have access to the corresponding tools. This is because the OAuth token granted has all the permissions that the Super Admin approved. Effectively, each integration will only have one valid OAuth token at a time, to be used by all users across the account.
For example, if I am a Super Admin and approve an integration that requires access to all content tools, any one of my colleagues who have access to these content tools can use the integration. If I have a colleague who only has access to sales tools, they will not be able to use the integration since it only uses the content tools in my HubSpot account.
