OAuth2 workflow in AWS Lambda function

Developer Support APIs & Integrations
1

Hello! I am a first-time hubspot app developer, working on an unlisted public app that can call the hubspot timeline API to create events for my company. Following the hubspot Timeline API docs I was able to create an event template and call that API in Postman with an OAuth2 bearer token, generated manually with with the nodejs quickstart app. so just faking it to get a token that will last for 30 minutes to play with.

I am expecting a small and infrequent number of requests coming through my app, so I would like to figure out a way to use an AWS serverless lambda function if possible. Should I either:

1. use AWS serverless lambda function, with access and refresh tokens stored in SSM Parameter Store to persist state between calls,

2. run something more like the quickstart app in an EC2 instance, and replace the get contact API call for my post timeline one,

3. or something else entirely?

Any advice or examples of doing the OAuth workflow on AWS would be greatly appreciated.

2

Hi, @dorviedev :waving_hand: Thanks for reaching out! Hey @nikodev @stefen do you have any suggestions for @dorviedev? Thank you! — Jaycee

3

Hello! I’ve made some progress in this and at least am moving in a direction. The Hubspot Academy tutorials on this were immensely helpful and got me up and running with a NodeJS express app that can accomplish the OAuth handshake and Timeline API requests.
To move this demo app to the cloud, I see a few options:

  1. Run mostly as-is in an EC2 instance or a container, use DynamoDB for cacheing tokens instead of a JS object
  2. Or try to break up the pieces to fit into a serverless model, also cacheing tokens in DynamoDB
    1. Try refactoring my app and using the serverless framework to deploy to AWS
    2. Or manually translate the steps of this demo app into AWS lambda functions with API Gateway triggers, one for the /oauth-callback to handle the initial handshake, one to /refresh tokens, and another to actually make the authenticated Timeline API call.

I also read somewhere the Hubspot refresh tokens do not expire. So a requested access-token may have a 30 minute TTL, but if my next request doesn’t come in for 4 hours, my app could still use the refresh token it already has to get a new access token.