Skip to main content
HubSpot is a bundled OAuth2 provider in authsome. HubSpot CRM objects: contacts, companies, deals, owners.

​
At a glance

​
Prerequisites

You need to register an OAuth app with HubSpot once. Create a HubSpot app in the developer dashboard. Configure the OAuth callback URL and request the scopes you need. The redirect URI must be:
This is the only callback URL authsome’s PKCE flow listens on. Dashboard: https://app.hubspot.com/developer.
HubSpot’s OAuth flow does not support PKCE today. Authsome runs the standard authorization-code flow with client_secret exchange.

​
Log in

The first time, authsome opens a local form at http://127.0.0.1:7998 to collect your client_id and client_secret. They are encrypted in your vault and reused on every subsequent login. A second browser window then opens to https://app.hubspot.com/oauth/authorize for the authorization step. Verify:

​
Custom scopes

The bundled definition requests crm.objects.contacts.read, crm.objects.contacts.write, crm.objects.companies.read, crm.objects.companies.write, crm.objects.deals.read, crm.objects.deals.write, crm.objects.owners.read. Override at login time:
The granted scopes are stored on the connection and visible in authsome get hubspot.

​
Multiple accounts

Pass --connection <name> on login and on every read command to keep two or more accounts on the same provider side by side. See Multiple connections per provider for the full pattern.

​
Use the token

Run the agent under the proxy (recommended).
Under the proxy, authsome sets HUBSPOT_ACCESS_TOKEN=authsome-proxy-managed in the child’s environment and injects the real token into outbound requests to api.hubapi.com. The child process never sees the actual value. Refresh tokens are never exported.

​
Override the bundled definition

User-registered files always win over bundled definitions.

​
What’s next

Run agents with the proxy

Inject the access token into outbound requests without exposing it.

Multiple connections per provider

Keep two or more accounts on the same provider side by side.

OAuth providers

All bundled OAuth providers.