3rd party integration - how to create fine-grained scope?

[JeffZ1]

Hi everyone, 

I need to allow a lead generation company to call the Hubspot API to send leads to my company's hubspot CONTACTS database directly. Is OAuth preferred over API key in this case? 

My concern is that how do I prevent the 3rd party from accidently deleting or modifying our current contacts? What happens if a contact's email already exists in our current CRM contacts? How should I define the scope in this case? 

Thanks

Jeff

[mangelet · Accepted solution]

Serverless functions provide a way to write server-side code that interacts with HubSpot and third-party services.

You can use whatever you want. HubSpot serverless functions are available through CMS Enterprise, but any serverless service out there works.

[mangelet]

@JeffZ1 

Consider creating a serverless function as a proxy to your HubSpot portal. 

Benefits

- You don't need to share your API key with them

- You can check for existing contacts before updating your database

[JeffZ1]

Thanks Martin! I appreciate your answer. 

Just want to clarify... By serverless function, do you mean using something like AWS API Gateway + Lambda?