We are currently implementing the new seamless install flow with partner signin for our app, but when testing the flow we get stuck on the “finalize” step.
I can see the following errors in the browser console:
Any idea how to get around this?
Hi there @IForecast,
Thank you for reaching out to the HubSpot Community and for sharing those details!
Here are a few resources that may be helpful as you troubleshoot:
- Seamless App Install Flow Documentation
- HubSpot Developer Docs: OAuth & App Authentication
The errors you’re seeing around X-Frame-Options and cross-origin loading are definitely worth a closer look — I’d love to get some of our top contributors and developer experts to weigh in on this one, as they may have run into something similar!
@HubSpot_Corey @ChrisoKlepke @nickdeckerdevs1 @KlemenHrovat — have any of you encountered X-Frame-Options or cross-origin issues during the seamless install finalize step? Would love your thoughts!
Cassie
Community Manager
Hi Cassie, thanks for the reply.
Is there a better place to ask technical questions like this?
Out of the 4 top contributers you tagged, only 1 seems to still be active on here.
Hi @IForecast,
I was able to do some digging into this, and here is what I found:
The error is due to a security header that you have on your website, which disallows cross-site iframing. The best solution is to remove the X-Frame-Options header and instead use a Content-Security-Policy header, which specifies frame-ancestors and includes the HubSpot domain as a safe parent for embedding.
Content-Security-Policy: frame-ancestors ‘self’ https://app.hubspot.com;
I hope this helps!
Cassie, Community Manager
Hi @chighsmith Thank you for your reply. Changing the response headers worked.
I ran into another issue with our session cookie where I had to change it to SameSite: None before it was readable from the iframe.
Despite these changes I am still getting stuck on the finalize step. The iframs loads correctly and appears to get redirected back to the returnUrl, but I still get a message saying “Error installing Forecast”
Hi @IForecast, thanks for the update! Glad the response headers and SameSite fix got you further along!
For the “Error installing Forecast” message at the finalize step, here are a few things worth checking:
State validation: Make sure the state token you receive at finalize matches what you stored during the authorize step. Since you already ran into a cookie/session issue with SameSite, it’s worth confirming the state was stored and retrieved under the same session context. If they don’t match, we will surface an install error.
Redirect to returnUrl: After exchanging the code for OAuth tokens, you must redirect to the returnUrl. Without this, HubSpot can’t complete the install.
Token exchange: Double-check that the code exchange against HubSpot’s token endpoint is succeeding. A mismatch in client_id, client_secret, or redirect_uri will fail silently and cause this error.
State token expiry: The recommended validity window is around 10 minutes. If there’s any delay between authorize and finalize, the token may have expired.
Let me know how this goes 
Cassie, Community Manager
Hi @chighsmith thank you for your reply.
I have found out that the token exchange was failing. It’s working now.
