Hello,
I am currently facing an issue when trying to connect an external application to HubSpot.
The application only requests the following OAuth scopes in the installation URL:
crm.objects.owners.read
crm.schemas.companies.write
crm.schemas.companies.read
crm.schemas.contacts.write
crm.schemas.contacts.read
crm.objects.contacts.write
crm.objects.contacts.read
crm.objects.companies.write
crm.objects.companies.read
However, during the authorization process, HubSpot displays a much broader set of required permissions, including:
- App Marketplace access
- Workflows > Delete
- Workflows > Edit
- Workflows > Enroll
- Workflows > Publish
- Account Access
- Marketing Access
- Sales Professional
- Add and edit teams
- Segments > Edit
- Partner Admin
- Edit property settings
These permissions appear unrelated to the scopes defined by the application and are significantly broader than expected.
Because of this, users are prompted to grant permissions that the application does not actually request or require.
Additionally, I have noticed that sometimes HubSpot asks for scopes that are supposed to be conditional scopes for the installed application. From my understanding, these scopes should only be requested if certain features are used or enabled, but they still appear during the authorization process.
My questions are:
- Why are these additional permissions being displayed during the authorization process when they are not included in the requested OAuth scopes?
- Could this behavior be related to account-level permissions, app configuration, or HubSpot portal settings?
- Why are scopes that are supposed to be conditional still being requested during installation?
- Is there a way to ensure that only the scopes explicitly requested by the application are shown to the user?
Any clarification would be greatly appreciated.
Thank you for your help.
Hi @alexdissi and welcome, it’s a pleasure to have you on the HubSpot Community!
Thanks for reaching out!
I’d like to share these resources as it may help:
- Working with OAuth
- App configuration
Now, let’s consult our Top Experts: Hi @SteveHTM, @nickdeckerdevs1 and @evaldas do you have suggestions to help @alexdissi, please?
Thanks so much and have a brilliant day! 
Bérangère
Hi @alexdissi 
In response to your questions:
- Why are these additional permissions being displayed during the authorization process when they are not included in the requested OAuth scopes?
- If the given conditionally required scope is not included in the install URL’s ‘scope’ parameter, my understanding is that it shouldn’t be displayed to the user. I’ve confirmed this behaviour on one of my test apps. Might be worth triple-checking the install URL being used and following up here if there are mismatches.
- Could this behavior be related to account-level permissions, app configuration, or HubSpot portal settings?
- Why are scopes that are supposed to be conditional still being requested during installation?
- See my answer to question 1
- Is there a way to ensure that only the scopes explicitly requested by the application are shown to the user?
- This is the way it should work, so please try again and share your install URL and a screenshot of the corresponding install permissions request if you’re still experiencing this issue.
If you haven’t already, it’s probably worth reviewing HubSpot’s “Scopes” developer documentation. I hope this proves helpful. Please let me know if you have any follow-up questions.
Hi @zach_threadint ,
Thank you for your response.
Regarding the install URL, here is the exact one currently being used:
https://app.hubspot.com/oauth/48797615/authorize?client_id=81bdc92e-8a34-4ab6-a904-79c8cd21948d&redirect_uri=https%3A%2F%2Fnexus.hublead.io%2Fcrm%2Fhubspot%2Fcallback&response_type=code&scope=crm.objects.owners.read+crm.schemas.companies.write+crm.schemas.companies.read+crm.schemas.contacts.write+crm.schemas.contacts.read+crm.objects.contacts.write+crm.objects.contacts.read+crm.objects.companies.write+crm.objects.companies.read+oauth&state=XXXX
All the permissions displayed in the URL above are intentionally included in the scope parameter. However, during the authorization flow, the HubSpot consent screen still displays additional permissions that are not part of the requested scopes.
I have double-checked that:
- The install URL is generated dynamically by our backend and matches exactly the one above.
- The scopes passed in the scope parameter are the only ones we intend to request.
- There are no additional scopes configured or appended dynamically on our side.
Despite this, the authorization screen still shows extra permissions that were never explicitly requested in the install URL.
Hi @alexdissi
Here are the scopes in that install URL you supplied (all provided in the ‘scope’ parameter):
- crm.objects.owners.read
- crm.schemas.companies.write
- crm.schemas.companies.read
- crm.schemas.contacts.write
- crm.schemas.contacts.read
- crm.objects.contacts.write
- crm.objects.contacts.read
- crm.objects.companies.write
- crm.objects.companies.read
- oauth
They seem to be consistent with what I’m seeing on the accept permissions page:
So now I’m thinking this could be related to the specific user permissions. In cases where the given user does not have the necessary permissions to install the app (typically this is done by Super Admins or people with App Marketplace permissions), I’m guessing HubSpot may be using all scopes in the given public app’s configuration (not just those supplied in the install URL) in their UI messaging. Would be good to hear from @BérangèreL on this theory.
I hope this proves helpful. Please let me know if you have any follow-up questions.
Hi @alexdissi and thanks for the tag @zach_threadint!
It’s important that the user installing the app has access to all the necessary permissions (scopes). If they don’t, such as if they aren’t a Super Admin or don’t have App Marketplace permissions, the installation won’t go through, and they’ll see an error page.
Sometimes, HubSpot will display all the scopes configured for the app, not just the ones included in the installation link.
Here are a few helpful reminders:
- Only Super Admins or users with the right Marketplace Access permissions can install apps.
- If someone tries to install without the proper permissions, the consent screen may look different than expected.
- The app’s required scopes (set in the app’s Auth settings) will always be enforced, even if they’re not listed in the URL.
For best results, have a Super Admin complete the installation. This will help confirm if the extra permissions disappear.
Also, double-check your app’s Auth settings to make sure there aren’t any additional scopes marked as required or conditionally required beyond what’s in your installation link.
I hope this helps!
Bérangère
This post was created with the assistance of AI tools
