We have developed a custom app and it works fine in the test env. Unfortunately, when I try to run it against the live env, I get errors like this:
Client error: `PUT https://api.hubapi.com/integrations/v1/221162/timeline/event` resulted in a `403 Forbidden` response:
{"status":"error","message":"This oauth-token (CMPiseiuLhICAQEY0bGuAyCewNIDKOq_DTIZACcTJA5M09nBB7C5fL7qslhVMvFYa88GszoYA (truncated...)
Notice how it helpfully truncates at the end, so I'm not really sure what it's complaining about. AFAICT we have entered the various API Keys and such correctly, at least getting a refresh token etc works fine, but not the call we're actually trying to run. What did we do wrong?
It's tough to say for sure what's going on based on that error alone, but generally a 403 means you're trying to make requests to an API that requires a scope that your access token was not granted. In this case, it seems like you're creating Timeline Events; this means that your access token needs to be from an installation to a production portal, and must have been granted the `timeline` scope.
Can you confirm that's the case here? I can also try to take a close look if you send over the Hub ID of the portal your app is installed in.
Final thing: It seems like your access token was truncated, but to be candid I'm not sure exactly how much of an access token needs to be exposed before it poses a security risk. To be safe, I'd renew this access token right away (if it hasn't already expired).
I must admit I still haven't understood the way dev and prod envs work in hubspot (they all look alike and there seems to be no way to tell which one belongs to where), but I configured it to the best of my knowledge, based on the information I pieced together from various support chats (if there is any real documentation on how it all works together let me know, I've read the doc links the chat peopl sent me, but that only made it more confusing).
I saw that the prod env actually lacked the timeline scope, so I added it, but it doesn't seem to make a difference. I still get the same error, so if you want to have a closer look that would be very helpful. The hub ID for the productive env is 7051473, the test env is 7848179.
Thanks in advance!
P.S.: Thanks for the heads-up about posting access tokens. The whole thing is still in development, so there's no real customer data at risk yet, but it's definitely good to know for the future
I can totally understand your confusion here. I'm not sure if it's outline quite like this in any of our documentation, but let me try to consolidate that info here. There are 3 portal "types" you need to worry about when building an app:
"Production" or "normal" portals
Developer portals
Developer test portals
Now before we get started, I want to call out that portal "types" isn't really a thing internally, on the backend these systems are a bit more complex. This can become relevant in situations like troubleshooting specific OAuth errors, but for the purposes of building an app we can use this categorization.
The way to think about each of these portal types is as follows:
"Production" portals are essentially the "core" HubSpot product. These portals have Marketing/Sales/Service/CMS Hub in some combination, and they're where HubSpot customers run their business. When building an app, these portals are the kind that belong to your users.
Developer portals are where you, as the developer, configure and monitor your app. These portals do not have Marketing/Sales/Service/CMS Hub in any combination, but they do have access to the HubSpot Developer Tools. When building an app, these portals (usually only one) belongs to you the developer.
Developer Test portals are where you, as the developer, test and troubleshoot your app. These portals do have access Marketing/Sales/Service/CMS Hub, but developer-specific testing versions that can't be used like a production account. When building an app, these portals are created and managed from a Developer portal, and belong to you the developer.
Knowing this, certain nuances of the OAuth process (and in particular, functionality like the Timeline API) becomes clearer: The Timeline API requires event definitions (which exist in a Developer portal) to create events (which exist in a Production portal).
When creating/updating event definitions, you're making a request that affects data in your Developer portal, and therefore need to use your developer hapikey.
When creating/updating instances of those events, you're making a request that affects data in a specific production portal, and therefore need to use an access token tied to that portal.
I hope that's helpful info, let me know if you have any other questions!
thanks for the detailed explanation, that clears up my confusion a bit. So basically developer portals are a bit like a dashboard (or like what e.g. Facebook does with their developer site), while test portals are more or less throwaway playgrounds to test your app in. Does that sound about right?
Just one more question, and then I'll leave you in peace: Is the dev portal somehow bound to a particular prod portal? i.e. if I have access to prod portals from two different customers, can I use the same dev portal to control separate apps in each of them? Also, is the dev portal bound to a particular login, or can I give someone from my team access to it somehow?
That's pretty much it, yea. To asnwer your follow up questions:
A developer portal is completely distinct from any production portals. There isn't any direct connection between a developer portal and a production portal. Production portals can install apps, and those apps are all managed from a developer portal, but that relationship doesn't introduce any connection between the developer and production portal.
Your specific example isn't 100% clear to me, but based on what I'm interpreting: The fact that you're a user in the two production portals isn't relevant to managing the configuration of the apps being installed. It may allow you to actually install the apps to the production portal yourself, but as a general rule that's not something that comes up except in rare circumstances.
Developer portals are full-blown HubSpot accounts in their own right, just with a very specific set of tools. This means that they're not bound to a specific login, and can have multiple users. You can add your teammates as users to your developer portal by following these instructions: https://knowledge.hubspot.com/settings/add-and-remove-users
.png "HubSpot Alumni"){kind=icon}
