OAuth2 Integration

[amorrell]

I'm looking to build integration from our own application into HubSpot and can do this with the hapikey approach but now want to implement OAuth2. For the purpose that we have there is NO connected user as we run the REST calls from a thread on a server. I'm stuggling to work out what we need to build to get the initial token as most of the documentation seems to assume I'm integrating a browser based application. Ideally if I have the values required to make a call via SOAP UI I can work it all out from there. I have the client id and client secret but not sure what I need for the redirect_uri or code parameters. We are using c# / .Net and RestSharp to make the requests. Pretty sure someone must have asked this but not finding the right solution. Can you help?

[Willson]

Hey @amorrell 

The redirect_uri or code parameters are part of the OAuth 2.0 flow that HubSpot supports, commonly known as the Authorization Code flow.

In order to initiate the integration, you will require a user to access the OAuth URL that is generated in your HubSpot Developers App, this initiates the integration to the Portal and authorizes the App with specific scope access. 

Once this is done, you'll be redirected to the redirect_URI, as this is not an App you're listing on a Marketplace and is only for your use, you can simply insert any URL you'd like, for testing purposes, I simply redirect to a page on my site. Once redirect, the code parameter will have been appended to your redirect_URI, you can now take this and and begin the process of requesting Access and refresh tokens as per our docs here.

I hope this helps! 

[amorrell]

Thank you, I'm a bit further forward as I now have a "code" value but to simulate what I will be doing in code I am tryign to build a SOAP UI request and that fails (all other requests via hapikey are working).

At this stage I just want to get a token now that I have the "code".

This is what I am sending but all I get back is an usupported media error

POST https://api.hubapi.com/oauth/v1/token HTTP/1.1
Accept-Encoding: gzip,deflate
grant_type: authorization_code
client_id: d3012eaa-25c8-4859-b82f-ffabb3569b49
client_secret: <HIDDEN>
redirect_uri: https://www.sonardyne.com/product/acoustic-and-optical-communications-family/
code: <HIDDEN>
Content-Type: application/json
Content-Length: 0
Host: api.hubapi.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

[Willson]

Hey @amorrell 

Would you be able to update the Content-Type to:

Content-Type: application/x-www-form-urlencoded;charset=utf-8

Once this is updated, make the request to see if this resolves the unsupported media error. Thanks!

[amorrell]

We are getting there . . . 

I now get {
"status": "BAD_GRANT_TYPE",
"message": "missing or unknown grant type",
"correlationId": "5cce83c3-94c7-408a-982a-09a7b50bceb5"
}

from this . . .

POST https://api.hubapi.com/oauth/v1/token HTTP/1.1
Accept-Encoding: gzip,deflate
grant_type: authorization_code
client_id: d3012eaa-25c8-4859-b82f-ffabb3569b49
client_secret: <HIDDEN>
redirect_uri: https://www.sonardyne.com/product/acoustic-and-optical-communications-family/
code: <HIDDEN>
Content-Type: application/x-www-form-urlencoded;charset=utf-8
Content-Length: 0
Host: api.hubapi.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

[Willson]

Hey @amorrell 

Could you clarify how these values are being passed? To confirm, these should be parameters in the request URL and not passed in the body. 

[amorrell]

Aha they were in the Header, If I pass as Query values I get this . . .

{
"status": "EXPIRED_AUTH_CODE",
"message": "auth code has expired",
"correlationId": "129714bc-4a25-4759-8562-07ee9499588e"
}

[Willson]

Great, the Code that gets returned when authenticating via the OAuth URL expires after 10 minutes, so in this case, simply generate a new one and make the request.

This should be successful and return the Access and Refresh Token for you.

I hope this helps!

[amorrell]

I cannot see how this is going to work if the code times out. Each time we need to makea  request we need a user to visit theOAuth link, then choose an account to connect with on the page then tick the I Am Not A ROBOT link just to get a code whic expires in 10 minutes.

I must be missing something here. We have a server which has no user in attendance and it will therefore need to make a connection.

I can achieve what we need with hapikey BUT it should be OAuth2 for security but cannot see how this works following the instructions on the web site and what you have told me so far.

[Willson · Accepted solution]

Hey @amorrell 

Apologies, allow me to clarify here! This part that we're doing is simply initiating the integration to obtain the Access and Refresh tokens. Once this is done, a simply API call is required every 6 hours to continually refresh the Access Token being used. 

Once the initial integration is done, the continued access is handled through the use of the Refresh token once obtained. The Access and Refresh tokens are used to continually allow access without the need to initiate each time as you're saying. To list the steps:

1. Initiate the integration
2. Request the Access and Refresh tokens
3. Once the initial Access token expires, use the Refresh token to refresh the access.
4. This process is then repeated every 6 hours as this is how long the Access token lasts for. 

However, the Refresh token does not expire. Therefore, if you fail to refresh the Access token within the 6 hours, you can still use the currently stored Refresh token to refresh the access. 

You can find more details on the steps involved in our 2.0 overview here.

I hope this better clarifies the process but do let me know if you have any questions.