token_type is required as per OAuth RFC but is missing in the token API response

Developer Support APIs & Integrations
1

When the token is granted (using Accounts Dashboard | HubSpot) it does not send back the token_type which seem to be a REQUIRED parameter as per OAuth RFC. Because of this I cannot use standard implementations of TokenClients.

If possible please fix soon.

Thanks

2

Hi @ggnagarkar

The token_type values will depend on which token you’re directly working with. If you’re working with the access_token, we have the following:

"token_type": "access"

This can be seen in our Documentation for getting the Access Token information:

For the refresh_token, we have:

"token_type": "refresh"

This can be seen in our Documentation for getting the Refresh Token information:

I hope this helps!

3

Good day, don’t think that provided answer can be accepted, token_type is used to find out how to utilize the access token (it is not describing how to use refresh token, because refresh token is not used for authorization calls). I don’t need additional call to distinguish between access and refresh tokens, because they are provided in different fields of response.

Spec contains few examples of token_type RFC 6749 - The OAuth 2.0 Authorization Framework

And according to spec (link was provided in original question) this field is required, if it is missing, your OAuth2 implementation can’t be use with spec-conformant OAuth2 clients.

BTW error response is also not following the spec RFC 6749 - The OAuth 2.0 Authorization Framework

4

Hello!

I agree with @betalb . The provided answer is not a solution to the initial problem. Standard OAuth libraries, which honor the specification, do not work with Hubspot OAuth implementation right now.