Restricting HubSpot App Installations to Specific Portal IDs

Developer Support APIs & Integrations
,
1

Hi everyone,

I’m building a HubSpot app using OAuth 2.0 and I want to restrict the installation of my app to only a specific set of HubSpot portals (identified by portalId). These portal IDs are stored in my backend DB (e.g., only clients who have onboarded with us).

Here’s the issue I’m facing:

  • When the user installs the app and is redirected to my redirect_uri, I receive the code parameter.
  • After exchanging the code for an access token using /oauth/v1/token, I can call the Get access token details (metadata) API to get the hub_id (portal ID).
  • However, by this time, the app is already installed and authorized in that portal.

What I want to do is:

:cross_mark: Prevent the app from connecting to portals not present in my allowlist
:white_check_mark: Only allow users from known portalIds to complete the OAuth flow and connect my app

:warning: Challenge:

Since the portalId is only available after token exchange, is there a secure way to check the portalId earlier in the flow (ideally before exchanging the code)?

Any guidance, recommended practices, or creative workarounds would be much appreciated!

Thanks in advance!

2

Hi @MKatewa,

Currently, HubSpot’s OAuth flow does not provide the portal ID until after the token exchange. This means you cannot block unauthorized portals before the app is installed. A workaround is to complete the OAuth process first. Immediately after, check the portal ID against your allowlist. If the portal is not authorized, revoke the token and notify the user that their portal is not permitted to use your app. Although this does not prevent the initial installation, it ensures that only approved portals can actually access your app’s features.

To improve user experience, maybe you can add a clear message on your app’s listing or website. Inform users which portals are eligible beforehand. This helps set expectations before they begin installation.