Hi,
we created a new app with only this scope
With a super admin we are able to installed it in a portal (4562905):
But when a user(basic user) try to initiate an Oauth2 after the application beeing installed.
We are getting this error:
Request for Integration Permissions
Couldn’t complete the connection
You don’t have permission to connect this integration. Learn more about integrations and user permissions.
This is the Oauth2 authorization url use to start the Oauth2 dance for the basic user.
Hi @lmmathurin , please take the time to read Derek’s response here: https://integrate.hubspot.com/t/this-hub-doesnt-have-access-to-some-hubspot-features-that-are-required-by-this-integration-please-contact-the-integrator/8940/12, it goes over much of your concerns.
That said, I think you may be thinking of HubSpot’s OAuth 2.0 flow in a way that’s not indicative of the way that it’s intended to function. What you describe sounds to me like an SSO type functionality sort of like when you sign into another platform with Google or with Facebook. That’s not the intended way for OAuth to work, and it will not work that way. Instead, I’d liken the OAuth flow to installing a game from the the App store on your iPhone. You must have an iPhone or Android, must have access to the app store, and must have a credit card to pay for the game, but once the game is installed, any person who is using your phone can play it.
The way that HubSpot OAuth should work is that you have an application in your Developer Account that requests access to a few specific scopes. The scopes being requested must be tools that the Account that’s installing the application has access to (example: if my app in its settings here: Developers | HubSpot requests access to Content, but my main production account does not have access to landing pages or any type of content tools, the app won’t be able to be installed). Further, the user who installs the application must have access to those tools as well. We normally suggest Super Admins to install the application, but there are situations in which non-Super Admins can install apps.
When the user goes to install an app and gets directed to this page:
the application is asking for which account they should generate Access and Refresh Tokens for. When the user confirms the scopes the app is requesting, HubSpot generates those tokens specific to the user, but the app can then be used by all users who have access to those scopes within the account. So the application is really an account-wide thing.
By having multiple users from the same account use your app and “sign in”, you’re technically just having them re-auth your app into the same portal, generating different refresh and access tokens each time.
If you need some more info on how OAuth in HubSpot works, I’d highly recommend reading this resource: https://medium.com/@darutk/diagrams-and-movies-of-all-the-oauth-2-0-flows-194f3c3ade85 and this topic:
https://integrate.hubspot.com/t/oauth-contact-permission-flow/11073/4
Thanks for responding.
As sais by the error message it was an permission issue. In my specific case, I was lacking the List access permission. Like I said to Derek this was not obvious from the documentation that the scope contacts was requiring the List permission as per the scope documentation. For integrators like us that want to build integration for sales people, usually sales and inside sales person does not have access to List (a Marketing feature).
Best regards,
LMM
