HubSpot

Overview

Connect your users to HubSpot for CRM data, contact management, deal tracking, and marketing automation.

Property	Value
Provider ID	hubspot
Category	CRM
PKCE	Supported
Token refresh	Automatic
Redirect URI	Shown in Developer Portal

Step 1: Create a HubSpot OAuth App

Install and authenticate the HubSpot CLI

Follow Create an app to install the HubSpot CLI (v7.6.0 or later), then authenticate with hs init or hs account auth. Apps are now created via the CLI from any standard HubSpot account — the legacy developer-account model was retired in March 2026.

Create a new project

Run hs project create and choose:

• Distribution: Marketplace or restricted installation
• Authentication: OAuth (for installation in multiple HubSpot accounts)

Configure OAuth settings

Edit the app’s top-level app-hsmeta.json file and add the Alter callback URL (from the Developer Portal) to the redirectUrls array. Add the required scopes under auth.requiredScopes. Then run hs project upload to deploy the app to HubSpot.

Get credentials

In the HubSpot account, go to Development > Projects, open the project, click the app name, and open the Auth tab. Copy the Client ID and Client secret.

Warning

Never share your Client secret publicly. Store it securely and only enter it in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add HubSpot provider

Go to OAuth Providers > Add Provider > HubSpot.

Enter credentials

• Client ID: Paste your HubSpot Client ID
• Client Secret: Paste your HubSpot Client secret

Select scopes

Choose the scopes the application needs.

Save

Click Save. The provider is now active.

Available Scopes

Scope	Description
crm.objects.contacts.read	Read contact records
crm.objects.contacts.write	Create, update, and delete contacts
crm.objects.companies.read	Read company records
crm.objects.companies.write	Create, update, and delete companies
crm.objects.deals.read	Read deal records
crm.objects.deals.write	Create, update, and delete deals

Notes

• HubSpot enforces granular scopes — request only what the application needs.
• Access tokens are short-lived (~30 minutes). Alter Vault handles automatic refresh using the refresh token.
• See the HubSpot OAuth documentation for more details.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
list_contacts	read	GET	/crm/v3/objects/contacts
get_contact	read	GET	/crm/v3/objects/contacts/{contact_id}
search_contacts	read	POST	/crm/v3/objects/contacts/search
create_contact	write	POST	/crm/v3/objects/contacts
update_contact	write	PATCH	/crm/v3/objects/contacts/{contact_id}
archive_contact	delete	DELETE	/crm/v3/objects/contacts/{contact_id}
list_companies	read	GET	/crm/v3/objects/companies
get_company	read	GET	/crm/v3/objects/companies/{company_id}
search_companies	read	POST	/crm/v3/objects/companies/search
create_company	write	POST	/crm/v3/objects/companies
update_company	write	PATCH	/crm/v3/objects/companies/{company_id}
archive_company	delete	DELETE	/crm/v3/objects/companies/{company_id}
list_deals	read	GET	/crm/v3/objects/deals
get_deal	read	GET	/crm/v3/objects/deals/{deal_id}
search_deals	read	POST	/crm/v3/objects/deals/search
create_deal	write	POST	/crm/v3/objects/deals
update_deal	write	PATCH	/crm/v3/objects/deals/{deal_id}
archive_deal	delete	DELETE	/crm/v3/objects/deals/{deal_id}