401 Error with User-Level OAuth Token for mcp.hubspot.com

[kavin_kr]

Hello,

I'm developing a multi-tenant chat application that integrates with HubSpot, similar to the ChatGPT connector. I'm using a Public App to handle the OAuth flow for multiple users.

I've successfully completed the OAuth 2.0 flow using the mcp.hubspot.com endpoints:

• Authorization URL -> https://mcp.hubspot.com/oauth/authorize

• Token URL -> https://mcp.hubspot.com/oauth/v1/token

The Problem:

When I use this access token to initialize the MCP client for the mcp.hubspot.com server, the authentication fails with a 401 Unauthorized error with the message: "Error POSTing to endpoint (HTTP 401): This endpoint requires a user level OAuth token"

Possible Issue:

I've verified access token using both the introspection endpoint (https://mcp.hubspot.com/oauth/v3/token/introspect) and the access token info endpoint (https://api.hubapi.com/oauth/v1/access-tokens/{token}). Both confirm the token is active and contains user-specific details like user, user_id, hub_id, and app_id. I did notice that within the token information, there is a nested field "signed_access_token": { "isUserLevel": false }, which is confusing.

Could anyone please clarify why this token isn't being accepted? Is there a different scope or process required specifically for the mcp.hubspot.com service?

Thank you the help.

[Jigar_Thakker · Accepted solution]

Hi @kavin_kr,

The MCP endpoint is expecting a user‑level OAuth token.

• Re-authenticate using the standard Authorization Code OAuth flow so a human user approves the app and you receive a user-bound access token (avoid private app tokens or server-to-server).
• Get a fresh access token and initialize your MCP client with that new token.
• If you’re using refresh tokens, ensure you refresh the access token before it expires to prevent 401s.

Confirm the token is tied to a specific user by calling GET /oauth/v1/access-tokens/{token} and checking the returned user information. https://developers.hubspot.com/docs/guides/api/app-management/oauth-tokens

If this helps, feel free to mark it as the solution ✔️ and give it an upvote 👍 !

[sejal_parikh]

Hey everyone, we launched beta for the remote MCP server at INBOUND. Here's the latest landing page on that https://developers.hubspot.com/mcp 

[kavin_kr · Accepted solution]

For those who are still facing this issue, follow the steps in the repo for the HubSpot Remote MCP integration - https://github.com/hubspotdev/user-level-app-template

[rrrk]

Hi, I went through the docs https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-hubspot-mcp-se... here as well, implemented the oauth server but when I try to initialize MCP client, same error:
> This endpoint requires a user level OAuth token

My scopes: crm.objects.contacts.write, oauth, crm.objects.companies.read, crm.objects.contacts.read

[sejal_parikh]

Hi @kavin_kr 

We don't have a general-use MCP connector available yet. We will keep you posted when we do release it. I'm curious to learn what type of multi-tenant chat application you are building and what use cases would it solve for. 

[kavin_kr]

Hi @sejal_parikh ,

I’m building a centralized AI hub for enterprises where they can interact with different models using their enterprise data.

1. Do you have plans to support public use? If so, any ETA would be helpful.
2. If there are no plans yet, our use case is very similar to your existing ChatGPT connector. Could you provide a special setup similar to what you did for ChatGPT?
3. If neither of the above is possible, could you provide some guidance on setting up a connector on top of the existing architecture?

Additional context:

• The app needs to be public so that multi-user OAuth is possible.
• How should we manage user permissions? The access token reflects the permissions granted at the time of initialization, but if a user’s permissions are later revoked, the token may still allow access. This creates a risk of resources being accessed through the AI even though the user no longer has access. Any guidance on how to properly validate user access would be very helpful.

Thanks

[keurcien]

Hi, is the https://mcp.hubspot.com endpoint open to any client? Would love to have read some docs about it.

[kavin_kr]

@keurcien  There isn’t any documentation available for it yet. I came across it through their blog and decided to test it out - https://product.hubspot.com/blog/unlocking-deep-research-crm-connector-for-chatgpt.

I’m hoping it will be available for public apps as well, so we don’t need to handle granular token access ourselves and can rely on the built-in permission model instead.

[Jigar_Thakker · Accepted solution]

Hi @kavin_kr,

The MCP endpoint is expecting a user‑level OAuth token.

• Re-authenticate using the standard Authorization Code OAuth flow so a human user approves the app and you receive a user-bound access token (avoid private app tokens or server-to-server).
• Get a fresh access token and initialize your MCP client with that new token.
• If you’re using refresh tokens, ensure you refresh the access token before it expires to prevent 401s.

Confirm the token is tied to a specific user by calling GET /oauth/v1/access-tokens/{token} and checking the returned user information. https://developers.hubspot.com/docs/guides/api/app-management/oauth-tokens

If this helps, feel free to mark it as the solution ✔️ and give it an upvote 👍 !

[kavin_kr]

Hi @Jigar_Thakker ,

Thanks for the reply. I followed the steps from the docs, but I'm still getting the same error. Actual values are replaced with $VALUES for brevity.

1. OAuth URL

https://app.hubspot.com/oauth/authorize?response_type=code&client_id=$CLIENT_ID&redirect_uri=$REDIRECT_URI&scope=oauth&optional_scope=$OPTIONAL_SCOPE&state=$STATE

Here is the OAuth screen for your reference.

2. Token Exchange

curl -X POST "https://api.hubapi.com/oauth/v1/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=authorization_code" \
     -d "code=$AUTH_CODE" \
     -d "client_id=$CLIENT_ID" \
     -d "client_secret=$CLIENT_SECRET" \
     -d "redirect_uri=$REDIRECT_URI"

3. Verified the access token metadata

curl -X GET "https://api.hubapi.com/oauth/v1/access-tokens/$ACCESS_TOKEN" \
     -H "Authorization: Bearer $ACCESS_TOKEN"

Response:

{
  "token": "...",
  "user": "...",
  "hub_domain": "...",
  "scopes": [
    "oauth",
    "crm.objects.contacts.read",
    "crm.objects.contacts.write",
    "crm.objects.companies.write",
    "crm.objects.companies.read",
    "crm.objects.deals.read",
    "crm.objects.deals.write",
    "crm.objects.owners.read"
  ],
  "signed_access_token": {
    "expiresAt": 1755802709136,
    "scopes": "...",
    "hubId": ...,
    "userId": ...,
    "appId": ...,
    "signature": "...",
    "scopeToScopeGroupPks": "...",
    "newSignature": "...",
    "hublet": "...",
    "trialScopes": "",
    "trialScopeToScopeGroupPks": "",
    "isUserLevel": false,
    "installingUserId": ...,
    "isServiceAccount": false,
    "isPrivateDistribution": false
  },
  "token_type": "access",
  "user_id": ...,
  "app_id": ...,
  "hub_id": ...,
  "is_private_distribution": false,
  "expires_in": 1798
}

4. But when I tried to initialize the MCP client with that access token, it is throwing the same error.

"Error POSTing to endpoint (HTTP 401): This endpoint requires a user level OAuth token"

Let me know if you need any other details.

[elie222]

Facing this same issue. Would love to hear an update. The docs feel lacking atm

[chighsmith]

Hi @elie222,

Thank you for posting to the Community!

Were you able to test out @Jigar_Thakker's Accepted Solution above? If so, where are you getting stuck? Can you share the steps you've taken thus far? 

Thank you!

Cassie, Community Manager