Hubspot: Authorization failed because there is a mismatch between the scopes in the install URL and the app's configured scopes.

[AndyBoot]

Trying to connect my Umbraco Forms Hubspot integration via OAuth and getting the error:

This is happening on an environment which has worked in the past. As https://hubspot-forms-auth.umbraco.com acts as the authentication / install URL I'm wondering if the issue is at your side? Unsure if anybody else having similar issues?

I cannot for the life of me find anything within Hubspot itself to find anything related to scopes.

I'm running Umbraco 13 (Umbraco.Forms.Integrations.Crm.Hubspot v4.0.1).

Thanks,
Andy

---

This item has been added to our backlog AB#49069

[acoumb]

Hi @AndyBoot ,
Could you walk me through your use case? I have tested with local and cloud instances, and did not experience what you are describing.

In my demo an error message shows up on one of HubSpot's pages briefly before getting redirected to our proxy page.

I've tested with two scenarios, one where I've cleared the cookies and connect to my HB account, and I manually input the authorization code in the workflow. And the second where I'm already logged in into my account.

Let me know if you have a similar setup, or if you have different questions.

Thanks,
Adrian

[AndyBoot]

Hi @acoumb, sorry for the delay in getting back to you, and thank you for taking the time to investigate this in-depth at your end. I'll spin up a test similar to how you've presented yours and see what results I get with our account. Will keep you posted

[AndyBoot]

Hi @acoumb, so I've tested a stock installation similar to your video and found it doesn't produce the same error as I previously mentioned. So far so good.

On further investigation I've found that we're using a forked version of the project which is enhanced to add Hubspot form submission functionality as well as the original contact creation/updates functionality. By having this extended capability it appears that an addition to scopes as defined at

Umbraco.Forms.Integrations/src/Umbraco.Forms.Integrations.Crm.Hubspot/Services/HubspotContactService.cs

Line 38 in c72c931

private const string OAuthScopes = "oauth%20forms%20crm.objects.contacts.read%20crm.objects.contacts.write";

required communication_preferences.read and communication_preferences.read_write.

This addition was made after our site was already authorised with OAuth which may explain why we've not seen it up until now. I can tweak the code from our side to ensure that the original scopes are sent during OAuth, but then use a different scope during API requests. Out of interest, does the endpoint at https://hubspot-forms-auth.umbraco.com receive the same scopes which explains the reason for the error? I guess if we're sending mismatched scopes this may confirm the reason for the error?

Thanks,
Andy

[AndyBoot]

Sorry, talking complete rubbish with my assumption that I can send different scopes between OAuth and API requests, given API requests don't interact with the scopes themselves... 😅

[AndyBoot]

I've been able to workaround this using a Private Access Token, but would be nice to return back to OAuth. Is there any way to adapt the scopes which the Umbraco endpoint sends to Hubspot? Or potentially self hosting our own copy of that endpoint?