Non-Super Admins aren't able to install Connected apps from third-party websites

[AGeorge8]

Hi there,

We’re facing the following issue with our HubSpot Connected App. The connected app we’ve built isn’t listed on App Marketplace yet and even if we list it there, the installation will be from our application (3rd party website) and not from the App Marketplace.

We use oauth to authenticate the app and scope only includes contacts and crm.import. Here’s our Install URL (client id + re-direct-uri are hidden for security purposes).

https://app-xyz.hubspot.com/oauth/authorize?client_id=<client-id>&redirect_uri=<re-direct-uri>&scope=contacts%20oauth%20crm.import

The ideal flow of events are as follows:

1. HubSpot Super admin creates a user who has just access to contacts and import permissions
2. Shares the login credentials with subscribers of our platform who are working with the client (who owns HubSpot) to connect the app to import leads into their HubSpot

The problem we’re running into is that, only Super-admin users (of free accounts) are able to connect/install the app from our application. For the lower-grade users (from free accounts) are getting this error “Couldn’t complete the connection. You don’t have permission to connect this app.”

Does HubSpot allow non-Super admins (from free accounts) to install apps into their HubSpot instance at all? If yes, what other permissions should we give? Right now, let's say, the Standard user has full permissions for 'Contacts & Companies' (except Delete), Import, and Marketing lists.

Any input on how to tackle this is highly appreciated.

[SSaraf]

@dennisedson I am linking my recent post about the same issue that was reported by @AGeorge8

https://community.hubspot.com/t5/APIs-Integrations/OAuth-Connection-Error-for-Non-Super-Admin-Users/...

Is there a solution to this? Here's a screenshot of our non-Super Admin user's permissions in HubSpot. When you say delete permission- are you referring to 'Permanently delete contacts' in my screenshot below. What else can I try to resolve this? Appreciate any guidance you can offer!

[bohart]

Hi HubSpot community,
That's terrible that non-super admins can't install Connected apps.

As for now, if some company develops some custom `Connected app` for internal usage (which should never be placed on the marketplace for everyone), only super admins can use it.

HubSpot should allow installing/authing Connected apps (which are non-listed at the marketplace) for non-super admins. Possible options:
1) allow if the verified domain from HubSpot account and the verified domain from Connected App to be the same.
2) allow after Super admin approval;
3) make an option for Super admin to have an allowlist of Connected apps for non-super admins.

Is there anyone from HubSpot team to comment on this topic?

Thanks!

[bohart]

The issue has been resolved for our team / for our app with some help from Hubspot development team. The solution is: non-super admin must be granted "Edit property settings" permission.
‍‍‍‍‍‍ ‍‍
Once non-super admin users are granted this permission, they will be able to install the app. Once the app is installed successfully, the permission can be removed from the user (the app and Oauth will continue work).
‍‍‍‍‍‍ ‍‍
Hopefully, this reply will help someone!

[SSaraf]

@bohart This did not work for us. Here's a screenshot of our non-Super Admin user's permissions in HubSpot. Did you have to make any scope changes for your app? I know it's been a year, but hope you can help. Here's my post about it requesting for help on this issue from this morning with some additonal details: https://community.hubspot.com/t5/APIs-Integrations/OAuth-Connection-Error-for-Non-Super-Admin-Users/... 

Any inputs will be much appreciated!

Thanks

Sonia

[Kamil_A]

Hi,

I'm facing similar issue. Did you manage to resolve it ?

Regards!

[dennisedson]

@AGeorge8 

If a user does not have delete permission, I would imagine that they do not have permissions dealing with the contacts scope. 

You should have some more granular control over the contacts scopes once the contact scope migration is completed.