OAuth Authorization problem

[CallingGuru]

Hi, until recently we had a working oauth authorization, but now , the user doesn't get redirected back to our application. 

In the console, there is the following error: 

Error: I18n.React is deprecated and will be removed from I18n. See go/i18n-help for more info.

What could be the cause? Is my problem description clear enough? Ty

[Derek_Gervais]

Hey @CallingGuru ,

I'm not sure of anything just yet, but that error doesn't sound like it's related. Is the only issue that you're not being redirected after approving the integration? Or are you getting any other error messages from HubSpot?

If possible, could you send me your authorization URL so I can take a closer look?

[CallingGuru]

Thank you @Derek_Gervais  for the quick reply: the authorization url that is generated is: 

https://app.hubspot.com/oauth/authorize?state=OPTIONAL_CUSTOM_CONFIGURED_STATE&scope=contacts+content+integration-sync+timeline+forms+files+business-intelligence&response_type=code&approval_prompt=auto&redirect_uri=https%3A%2F%2Fclient.calling.guru%2Fintegrations%2Fhubspot%2Foauth_connect&client_id=4bd7548e-d2b7-4f08-bcfe-1b5e3ed84713

Does that shed any light? 

I do not get an error message, I just get this screen:

[CallingGuru]

Additionally, there are these errors in the console (while staying on that loading screen as pasted above)

So I think this is the culprit: 

Error: "Request for https://api.hubspot.com/oauth/v1/application-authorizations?portalId=2085618&clienttimeout=14000 failed with status 403. Forbidden"

[Derek_Gervais]

Hey @CallingGuru ,

Yes that definitely seems to be the issue, although I haven't been able to reproduce it by starting the OAuth flow using your authorization URL. I also created an account and completed the installation to my own account, without being able to reproduce this. Is this only happening with a specific account or set of accounts? I'm wondering if that particular account/user is missing the tool(s)/permission(s) required; it looks like that's a free account, so perhaps there's some content tool/permission missing?

As for why it's just showing a blank page; I'll need to dig in closer and reproduce the issue to say for sure. Can you give me the Hub ID of the account(s) where you're able to reproduce this? Also, can you check out the network tab for the entry that lines up with the error you're seeing, and check for an error response body?

[CallingGuru]

Dear @Derek_Gervais , thank you for trying this out. We have this on our own hubspot account on which we also have access to some accounts of customers. 

So after the redirect, we need to choose 'calling guru', or one of the customer accounts. 

This also seems to be a free account. 

One new client also has the same problem (I don't know if they manage multiple companies). 

If we limit the scope of the request to 'contacts', the problem remains. 

The Hub ID is 2085618

Network tab: 

[Derek_Gervais · Accepted solution]

Hey @CallingGuru ,

Thanks for the details here. From what I'm seeing, this appears to be a user-role related error. It seems there's an issue now where the user-friendly error message page isn't loading successfully for some reason, which has made troubleshooting this more challenging.

In your case; I would recommend asking your customers to have a super-admin try the installation. This should ensure that the person installing the integration has all of the required roles to approve the installation.

For additional information on troubleshooting HubSpot OAuth issues, check out the following forum post: https://community.hubspot.com/t5/APIs-Integrations/HubSpot-OAuth-FAQ/m-p/262729#M23479

[CallingGuru]

Dear @Derek_Gervais 

Thank you for the feedback. 

Using a superadmin works. However, it is possible that the representative of our client does not have superadmin powers, but does have the necessary roles.  

We just setup an example where we only request the 'contacts' scope, with a user that has that role assigned. And that user isn't able to login. 

Is it always required to confirm the integration with a superadmin role? (I don't think it used to be that way). 

Thank you!

[Derek_Gervais]

Hey @CallingGuru ,

The specifics here can be very tricky; the OAuth forum post I linked to has some clarifying details. The biggest takeaway: Whether or not an app can be installed depends on the intersection of the app's required scopes, the account’s included tools, and the authorizing user's roles

There are situations in which it might appear that a user has all the proper permissions, when they're actually missing some key role. There are also some known issues that impact whether or not a connection will be success. For example, a user must have access to the lists in order to approve the `contacts` scope, even though the lists settings appear under the "Marketing" tab. Similarly, due to a quirk in the way Marketing Free portals work, the `contacts` scope can only be approved by a super admin.

While it shouldn't always require a super admin to install an integration, that's functionally the best way to guarantee that the connection will be made, since a super admin is always going to have the proper permissions. If you have specific account/user combinations you're investigating, I can check into them for you. Otherwise, the best general advice is going to be to try the installation again with a super admin.

[CallingGuru]

Thank you for the clear communication. Client has been onboarded using a superadmin role. Greetings.