I am testing what minimal user permissions are required to authorize API access for my app. It works fine for non super admins when I use the scope crm.objects.contacts.write etc. if I turn on the necessary user permission for standard users. With the scope crm.objects.users.read I keep getting the error that the user doesn’t have the correct permissions during the OAuth flow.
Which user permission do I need to turn on for non super users to allow my app access for crm.objects.users.read?
Hi @_Bram
I’ll try to break this down.
1) crm.objects.users.read lets an app hit the User Details API, which surfaces every user’s profile and team info; HubSpot treats that as sensitive, so only Super Admins (or users that have the full Add and edit users / Account access privilege, which is effectively the same in the permission model) can grant it — standard users, even with broad CRM rights, will hit an “insufficient permissions” error during the OAuth screen (HubSpot Community).
2) Giving a non‑admin the Add and edit users toggle under Settings › Users & Teams promotes them to an admin‑level role and is the only way HubSpot will let that user approve the scope (HubSpot Knowledge Base).
3) There’s no lighter “view‑only users” permission today, so if you want the install flow to work for regular users you have two options: a) drop the scope entirely and use a different endpoint (for example, Owners API) or b) flag it as an optional scope in the dev portal; then non‑admins can finish OAuth, but calls to /crm/v3/objects/users will 403 unless the installer was a Super Admin (HubSpot Developers ).
4) If your app only needs to know which user installed it or to look up the current owner of a record, swap to crm.objects.owners.read (same restriction) or query the OAuth token metadata (/oauth/v1/access-tokens/{token}) instead, which returns the installer’s user and user_id without extra scopes.
5) Bottom line: to unblock testing, have a Super Admin install the app, or upgrade the tester’s permissions; for production, decide whether you truly need the full users object or can live with lighter data so non‑admin customers can connect without elevating their rights.
Hope it helps.
Real-Time Data Sync Between any CRM or Database | Founder @Stacksync (YC W24)
Thank you so much for the explanation. It surely helps to understand. What I want is to read the users email and/or phone numbers. This isn’t present in the owners so I guess your suggestion is probably my best option.