--- title: "HubSpot Has the OAuth, but Not the Onboarding" url: https://daily.dev/posts/hubspot-has-the-oauth-but-not-the-onboarding-okwqcfgri source_url: https://apievangelist.com/2026/08/25/hubspot-oauth-but-create-the-app-by-hand type: article source: "API Evangelist" published: 2026-08-25T10:44:07.240Z updated: 2026-08-25T10:44:34.902Z tags: ["architecture", "nodejs", "authentication", "oauth", "hubspot"] reading_time: 12 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HubSpot Has the OAuth, but Not the Onboarding **[API Evangelist](https://daily.dev/sources/apievangelist)** · 12 min read · 0 upvotes · 0 comments ## Summary HubSpot has no API to programmatically create an app: public apps require clicking through a Developer Account UI to get a client_id/client_secret, and private apps require a super admin generating a pat- token through Settings. Once you have credentials, though, HubSpot's OAuth flow is clean: a confidential-client authorization-code grant (no PKCE) against app.hubspot.com/oauth/authorize and api.hubapi.com/oauth/v1/token, plus a token-info endpoint to verify scopes, hub_id, and app_id. A companion Node.js script, hubspot-api-auth.mjs, automates everything scriptable - the browser-based OAuth exchange or verifying a pat- token - while leaving app creation as the manual, dashboard-only step. The piece argues HubSpot should expose a scoped endpoint to register apps and mint credentials so agents could provision their own integrations end to end. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Does HubSpot support PKCE for OAuth, or does it require a client secret? HubSpot OAuth does not support PKCE. It uses the confidential-client authorization-code grant, requiring a client_id and client_secret held server-side. You redirect users to app.hubspot.com/oauth/authorize, then exchange the returned code via a POST to api.hubapi.com/oauth/v1/token with grant_type=authorization_code, receiving an access_token, refresh_token, and an expires_in of about thirty minutes. _daily.dev helps developers track OAuth implementation quirks like this before wiring up a HubSpot integration._ ### Is there an API to create a HubSpot app or generate client_id and client_secret programmatically? No, HubSpot has no API endpoint to create an app. Public apps must be created manually in the Developer Account UI under Apps, and private apps must be created by a super admin in the portal under Settings, Integrations, Private Apps. There is no POST /apps or Dynamic Client Registration endpoint, so minting a client_id, client_secret, or pat- token always requires a dashboard step. _Developers automating agent-driven integrations follow gaps like HubSpot's missing app-creation API on daily.dev._ ### How do I verify a HubSpot OAuth access token and see what scopes and account it belongs to? Send a GET request to https://api.hubapi.com/oauth/v1/access-tokens/{token} to verify an OAuth access token; it returns the hub_id, hub_domain, user, granted scopes, and app_id. For private-app pat- tokens, use the account-info endpoint at https://api.hubapi.com/account-info/v3/details instead, since the access-tokens endpoint is not documented to accept pat- tokens. _daily.dev supports engineers verifying token scopes and access as they script HubSpot integrations._ ## Similar posts on daily.dev - [Shopify Lets You Script the Token, Not the App](https://daily.dev/posts/shopify-lets-you-script-the-token-not-the-app-a6cr6ybdt) · API Evangelist · 0 upvotes · 0 comments - [GitHub Quietly Built the Onboarding Flow Everyone Else Is Missing](https://daily.dev/posts/github-quietly-built-the-onboarding-flow-everyone-else-is-missing-gk4jwdvby) · API Evangelist · 0 upvotes · 0 comments - [Slack Can Actually Mint App Credentials From a Script, If You Survive the Bootstrap](https://daily.dev/posts/slack-can-actually-mint-app-credentials-from-a-script-if-you-survive-the-bootstrap-6xzzokqtq) · API Evangelist · 0 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#nodejs](https://daily.dev/tags/nodejs), [#authentication](https://daily.dev/tags/authentication), [#oauth](https://daily.dev/tags/oauth), [#hubspot](https://daily.dev/tags/hubspot) [View this post on daily.dev](https://daily.dev/posts/hubspot-has-the-oauth-but-not-the-onboarding-okwqcfgri)