# static-auth v3 project card calling an external HTTPS endpoint **URL:** \ **Category:** HubSpot-built Apps\ **Tags:** account-engagement\ **Created:** [December 26, 2025, 4:18am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372 "2025-12-26T04:18:47Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Sna919](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Sna919](https://community.hubspot.com/u/Sna919)\ **Post date:** [December 26, 2025, 4:18am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/1 "2025-12-26T04:18:47Z")
Questions: 1. For a static-auth v3 project card calling an external HTTPS endpoint via hubspot.fetch, what is the exact allowed header set? 2. Is there any known limitation or additional requirement for outbound proxy calls from static-auth cards that would explain the persistent 431 in the setup? I’m just trying to POST a small JSON payload from the card to my backend and would appreciate guidance on the supported pattern for headers in this scenario (especially whether Authorization is actually allowed here, and under what conditions). ---
**Author:** ![Victor\_Becerra](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@Victor\_Becerra](https://community.hubspot.com/u/Victor_Becerra)\ **Post date:** [December 26, 2025, 4:02pm UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/2 "2025-12-26T16:02:29Z")
Hi @Sna919 👋 Thank you for reaching out to the Community! I’d like to invite some community members who are subject matter experts in project cards and hubspot.fetch to join this conversation. Hello there @seosiri @RubenBurdin @danmoyle Would you be able to share any insights on the allowed header set for static-auth v3 cards (especially Authorization) and what commonly triggers persistent **431** errors when calling an external HTTPS endpoint? Your expertise would be greatly appreciated. Best, Victor ---
**Author:** ![danmoyle](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/danmoyle/32/91166_2.png) [@danmoyle](https://community.hubspot.com/u/danmoyle)\ **Post date:** [December 29, 2025, 6:28pm UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/3 "2025-12-29T18:28:43Z")
Thank you for thinking of me [@Victor\_Becerra](https://community.hubspot.com/t5/user/viewprofilepage/user-id/620965) but I think @Sna919’s question is beyond my particular skillset 😁 @Sna919 if I were in your shoes, I’d take to an AI engine and pore over the resources that come up. I’d also check with the HubSpot Developer Community. Maybe someone there has good insights to help. ---
**Author:** ![Victor\_Becerra](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@Victor\_Becerra](https://community.hubspot.com/u/Victor_Becerra)\ **Post date:** [December 29, 2025, 7:59pm UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/4 "2025-12-29T19:59:25Z")
Thanks so much for the reply, @danmoyle — I really appreciate you taking a moment to weigh in. Totally understand, and your suggestion to check the Developer Community is a great call. Always grateful for your willingness to jump into these threads and help guide folks in the right direction 😊 Best, Victor ---
**Author:** ![seosiri](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/seosiri/32/10759_2.png) [@seosiri](https://community.hubspot.com/u/seosiri)\ **Post date:** [December 28, 2025, 9:11am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/5 "2025-12-28T09:11:28Z")
1) Allowed headers in hubspot.fetch (static-auth v3 card) Only these are allowed: Content-Type Accept Anything else (including small headers) is rejected. 2) Reason for persistent 431 Request Header Fields Too Large Authorization headers are NOT allowed HubSpot runs static-auth cards behind a locked outbound proxy Any non-allowlisted header causes the proxy to reject the request Payload size is irrelevant This is expected behavior, not a misconfiguration. 3) Is Authorization allowed? No. Never. Authorization headers are blocked in all static-auth v3 cards. Allowed only in: HubSpot serverless functions OAuth / CRM extensions Backend-to-backend calls 4) Supported way to POST JSON from a static-auth card hubspot.fetch(url, { method: “POST”, headers: { “Content-Type”: “application/json”, “Accept”: “application/json” }, body: JSON.stringify(payload) }); Authentication must be in the body or handled server-side. TL;DR Headers allowed: Content-Type, Accept Authorization: ❌ not allowed 431: expected proxy rejection Fix: public ingress or serverless proxy ---
**Author:** ![Sna919](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Sna919](https://community.hubspot.com/u/Sna919)\ **Post date:** [December 30, 2025, 5:36am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/6 "2025-12-30T05:36:14Z")
Thank you @seosiri for the reply. I updated my static-auth v3 card to use: hubspot.fetch(“\”, { method: “POST”, headers: { “Content-Type”: “application/json”, “Accept”: “application/json”, }, body: JSON.stringify({ secret: “\”, data: { /\* some small JSON payload \*/ } }), }); No Authorization or other custom headers; authentication is only in the body. However, I’m still consistently seeing: { “message”: “Only ‘Authorization’ header is allowed. For questions about this, please use: [HubSpot Developer Feedback Form](https://developers.hubspot.com/feedback)”, “category”: “REQUEST\_HEADERS\_FIELDS\_TOO\_LARGE” } **Questions:** 1. Is this expected when a static-auth v3 card POSTs to an external HTTPS domain via hubspot.fetch + /execution/internal/v3/proxy, even when only Content-Type and Accept are set and all auth is in the body? 2. If so, what is the recommended pattern for a static-auth v3 card that needs to send a small JSON payload to an external backend? ---
**Author:** ![seosiri](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/seosiri/32/10759_2.png) [@seosiri](https://community.hubspot.com/u/seosiri)\ **Post date:** [December 30, 2025, 6:46am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/7 "2025-12-30T06:46:38Z")
### Step-by-step #### **1. UI Extension (static-auth v3 card)** Your card **must NOT call external HTTPS services directly**. Instead, call a **HubSpot serverless function** : hubspot.fetch(“/\_hcms/api/my-proxy-endpoint”, { method: “POST”, headers: { “Content-Type”: “application/json” }, body: JSON.stringify({ data: { /\* small JSON payload \*/ } }) }); ` ` ✔ Internal calls are allowed ✔ No proxy header restrictions ✔ Fully supported ---
**Author:** ![seosiri](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/seosiri/32/10759_2.png) [@seosiri](https://community.hubspot.com/u/seosiri)\ **Post date:** [December 30, 2025, 6:48am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/8 "2025-12-30T06:48:03Z")
Your serverless function then safely calls your external backend using fetch / axios: exports.main = async (context, sendResponse) =\> { const payload = context.body; const response = await fetch(“[https://external-domain.com](https://external-domain.com)”, { method: “POST”, headers: { “Content-Type”: “application/json”, “Authorization”: “Bearer YOUR\_SECRET” }, body: JSON.stringify(payload), }); const result = await response.json(); sendResponse({ body: result }); }; ✔ Full control over headers ✔ Auth can be in headers or body ✔ No HubSpot proxy restrictions ---
**Author:** ![Sna919](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@Sna919](https://community.hubspot.com/u/Sna919)\ **Post date:** [December 31, 2025, 1:38am UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/9 "2025-12-31T01:38:52Z")
Thank you @seosiri and @RubenBurdin ---
**Author:** ![RubenBurdin](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rubenburdin/32/75212_2.png) [@RubenBurdin](https://community.hubspot.com/u/RubenBurdin)\ **Post date:** [December 30, 2025, 7:30pm UTC](https://community.hubspot.com/t/static-auth-v3-project-card-calling-an-external-https-endpoint/144372/10 "2025-12-30T19:30:18Z")
Hey @Sna919 Yeah this is a frustrating one. The error message is actually a bit misleading, it says “Only Authorization header is allowed” but thats not quite accurate for static-auth cards. What’s happening is the outbound proxy for static-auth v3 cards is extremely restrictive and basically blocks most external calls regardless of headers. seosiri’s suggestion is the right path forward. You need to route through a HubSpot serverless function as an intermediary. The card calls your serverless function internally (which works fine), then the serverless function makes the actual external call with whatever headers you need. Its an extra hop but its the only reliable pattern I’ve seen work consistently. One thing to double check, make sure your serverless function is defined in your project’s serverless.json and the endpoint path matches what you’re calling from the card. I’ve seen folks get tripped up when the function isn’t properly registered or the route doesnt match. HubSpot’s docs on serverless functions cover the setup ([https://developers.hubspot.com/docs/platform/serverless-functions](https://developers.hubspot.com/docs/platform/serverless-functions)). If the reason you need to call your backend is to sync or pull data into HubSpot records, there might be simpler approaches depending on your use case. At Stacksync we handle alot of HubSpot to database sync scenarios where people originally tried building custom integrations and ran into exactly these kinds of platform limitations. Sometimes the easier path is keeping the data in sync automatically rather than fetching on demand from a card. Note: This response was written based on my own experience and lightly reformatted with AI for clarity. Hope you get it sorted!