OAuth scopes issue while setting up my public app

[PBallerscheff]

Hi everyone,

I’m running into an OAuth scopes issue while setting up my public app, and I could use some guidance.

Here are the details:

• Scopes added in my HubSpot public app:
  Loom | Free Screen & Video Recording Software | Loom

• Scopes defined in my code (SCOPES list):
  Loom | Free Screen & Video Recording Software | Loom

  • Hosting & Redirect URL:
    Hosted on Render → https://hubspot-einrichtung.onrender.com/
    Redirect URI: https://hubspot-einrichtung.onrender.com/oauth/callback

  • Error when testing installation in my developer’s test account:
    https://www.loom.com/i/92ad817c8fa647cab86663e286c85dbf
    (“Die Autorisierung ist fehlgeschlagen, weil die angegebenen Bereiche nicht ausreichend sind.”)

  • My user setup:
    Super Admin
    Sales Enterprise Trial + Service Enterprise Trial
    Loom | Free Screen & Video Recording Software | Loom

    ---

    My Goal

    I want to create a public app that helps us set up client HubSpot accounts according to our schema more quickly. That means:

    • Creating deals, contacts, companies, lists

    • Defining and editing custom properties and objects

    • Eventually managing deal stages/pipelines via API

    • Later connecting all data to Supabase for persistence

        ---
      
        ### The Issue
      
        Even though I have aligned the scopes in both the HubSpot developer app and my code, the install still fails with the *“scopes not sufficient” error.*
      
        ---
      
        ### My Questions
      

      1. Do my current scopes cover everything needed for my use case (objects, custom schemas, lists, etc.)?

      2. Which additional scopes are required for deal stages and pipeline management?

      3. Is there a way to debug whether the test account itself lacks access to the requested scopes, even with Super Admin + Enterprise Trial?

                Any help or guidance would be hugely appreciated 🙏
         

[Jaycee_Lewis]

Hey, @PBallerscheff One quick quesiton, in your Public App scopes, can you select the `crm.schemas.custom.write` scope? — Jaycee

[PBallerscheff]

Hi Jaycee! I am not able to select that option.

Loom | Free Screen & Video Recording Software

What do I need to do in order for that to be an option?

[RubenBurdin]

Hi @PBallerscheff

First thing: the “scopes not sufficient” error usually means the scopes your app is asking for in the URL don’t exactly match what you’ve enabled in the App settings.

Even a small mismatch (extra space, missing scope) can trigger that. HubSpot’s doc on scopes is useful here: (Scopes - HubSpot docs )

For pipelines and deal stages, you’ll need crm.objects.deals.write plus crm.objects.schemas.write to manage pipeline definitions. The tricky part is that some scopes, like crm.schemas.custom.write, only show up for private apps today

They’re not yet available for public apps, which explains why you couldn’t select it. HubSpot confirms this here: (Working with OAuth | OAuth Quickstart Guide - HubSpot docs )

To debug, install the app again but capture the full URL you’re redirected to. Check the scope= parameter against your developer app’s selected scopes. If the requested scope isn’t toggled in the developer UI, HubSpot will block the install even if your test account is Enterprise + Super Adminn

Practically, your current set should let you create deals, contacts, companies, and lists. But schema edits for custom objects are the sticking point you may need to test those via a private app until HubSpot exposes the scope for public ones.

And as a side note, since you mentioned connecting Supabase later: some teams sidestep these scope headaches by using a sync platform that handles OAuth, tokens, and retries in the background. Something like Stacksync keeps HubSpot and Supabase aligned in real-time without managing scopes manually.

Hope this helps.

[PBallerscheff]

Hi @RubenBurdin,

I want to make sure I’ve understood the split between public and private apps correctly, and check if my approach makes sense, based on what is currently possible in HubSpot:

Public app → client installs via OAuth link. This should handle everything that is supported in public apps today, namely:

• Creating properties for standard objects (contacts, companies, deals) — e.g. our “8 custom properties” that we add in every client portal.
• Creating and managing records (contacts, companies, deals).
• Creating lists and list memberships.
• Creating views.
• Creating tasks.
• Creating email templates.
• Creating meetings.

That way, I can push out a consistent “standard manifest” across all client portals via the public app.

Private app → since pipelines and custom objects/schemas aren’t available to public apps yet, I’d handle those per client using a private app. That would cover:

• Creating pipelines and pipeline stages.
• Creating pipeline popups.
• Creating custom objects and schemas.

My current thinking for the workflow is:

1. Client installs the public app first.

2. For the custom schema step (pipelines, pipeline popups, custom objects), either:

   • Client invites me temporarily as Super Admin (no paid seat needed), or
   • Client generates a one-time private app token with minimal scopes, pastes it into my setup screen, I provision the custom schemas, and they revoke it after.

That way, clients never have to code or configure APIs themselves, but I can still apply our full standard setup.