{"id":2682,"date":"2026-03-11T09:31:38","date_gmt":"2026-03-11T10:31:38","guid":{"rendered":"http:\/\/gogetmuscle.com\/?p=2682"},"modified":"2026-03-11T17:40:07","modified_gmt":"2026-03-11T17:40:07","slug":"unexpected-permission-requirements-when-connecting-an-external-app-oauth-scopes-mismatch","status":"publish","type":"post","link":"http:\/\/gogetmuscle.com\/index.php\/2026\/03\/11\/unexpected-permission-requirements-when-connecting-an-external-app-oauth-scopes-mismatch\/","title":{"rendered":"Unexpected permission requirements when connecting an external app (OAuth scopes mismatch)"},"content":{"rendered":"<p><P class=\"\">Hello,<\/P><P class=\"\">I am currently facing an issue when trying to connect an external application to HubSpot.<\/P><P class=\"\">\u00a0<\/P><P class=\"\">The application only requests the following OAuth scopes in the installation URL:<\/P><P class=\"\">crm.objects.owners.read<BR \/>crm.schemas.companies.write<BR \/>crm.schemas.companies.read<BR \/>crm.schemas.contacts.write<BR \/>crm.schemas.contacts.read<BR \/>crm.objects.contacts.write<BR \/>crm.objects.contacts.read<BR \/>crm.objects.companies.write<BR \/>crm.objects.companies.read<\/P><P class=\"\">\u00a0<\/P><P class=\"\">However, during the authorization process, HubSpot displays a much broader set of required permissions, including:<\/P><UL><LI><P class=\"\">App Marketplace access<\/P><\/LI><LI><P class=\"\">Workflows &gt; Delete<\/P><\/LI><LI><P class=\"\">Workflows &gt; Edit<\/P><\/LI><LI><P class=\"\">Workflows &gt; Enroll<\/P><\/LI><LI><P class=\"\">Workflows &gt; Publish<\/P><\/LI><LI><P class=\"\">Account Access<\/P><\/LI><LI><P class=\"\">Marketing Access<\/P><\/LI><LI><P class=\"\">Sales Professional<\/P><\/LI><LI><P class=\"\">Add and edit teams<\/P><\/LI><LI><P class=\"\">Segments &gt; Edit<\/P><\/LI><LI><P class=\"\">Partner Admin<\/P><\/LI><LI><P class=\"\">Edit property settings<\/P><\/LI><\/UL><P class=\"\">\u00a0<\/P><P class=\"\">These permissions appear unrelated to the scopes defined by the application and are significantly broader than expected.<\/P><P class=\"\">\u00a0<\/P><P class=\"\">Because of this, users are prompted to grant permissions that the application does not actually request or require.<\/P><P class=\"\">\u00a0<\/P><P class=\"\">Additionally, I have noticed that sometimes HubSpot asks for scopes that are supposed to be <SPAN class=\"\"><STRONG>conditional scopes<\/STRONG><\/SPAN> for the installed application. From my understanding, these scopes should only be requested if certain features are used or enabled, but they still appear during the authorization process.<\/P><P class=\"\">\u00a0<\/P><P class=\"\"><STRONG>My questions are:<\/STRONG><\/P><OL><LI><P class=\"\">Why are these additional permissions being displayed during the authorization process when they are not included in the requested OAuth scopes?<\/P><\/LI><LI><P class=\"\">Could this behavior be related to account-level permissions, app configuration, or HubSpot portal settings?<\/P><\/LI><LI><P class=\"\">Why are scopes that are supposed to be conditional still being requested during installation?<\/P><\/LI><LI><P class=\"\">Is there a way to ensure that only the scopes explicitly requested by the application are shown to the user?<\/P><\/LI><\/OL><P class=\"\">Any clarification would be greatly appreciated.<\/P><P class=\"\">\u00a0<\/P><P class=\"\">Thank you for your help.<\/P><P class=\"\"><span class=\"lia-inline-image-display-wrapper lia-image-align-inline\" style=\"width: 999px\"><img src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" role=\"button\" title=\"Screenshot 2026-03-11 at 11.13.30.png\" alt=\"Screenshot 2026-03-11 at 11.13.30.png\" class=\"lazyload\" data-src=\"http:\/\/gogetmuscle.com\/wp-content\/uploads\/2026\/03\/large\"><\/span><span class=\"lia-inline-image-display-wrapper lia-image-align-inline\" style=\"width: 999px\"><img src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" role=\"button\" title=\"Screenshot 2026-03-11 at 11.25.50.png\" alt=\"Screenshot 2026-03-11 at 11.25.50.png\" class=\"lazyload\" data-src=\"http:\/\/gogetmuscle.com\/wp-content\/uploads\/2026\/03\/large-1\"><\/span><span class=\"lia-inline-image-display-wrapper lia-image-align-inline\" style=\"width: 999px\"><img src=\"data:image\/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==\" role=\"button\" title=\"Screenshot 2026-03-11 at 11.26.02.png\" alt=\"Screenshot 2026-03-11 at 11.26.02.png\" class=\"lazyload\" data-src=\"http:\/\/gogetmuscle.com\/wp-content\/uploads\/2026\/03\/large-2\"><\/span><\/P><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello,I am currently facing an issue when trying to connect an external application to HubSpot.\u00a0The application only requests the following OAuth scopes in the installation URL:crm.objects.owners.readcrm.schemas.companies.writecrm.schemas.companies.readcrm.schemas.contacts.writecrm.schemas.contacts.readcrm.objects.contacts.writecrm.objects.contacts.readcrm.objects.companies.writecrm.objects.companies.read\u00a0However, during the authorization process, HubSpot displays a much broader set of required permissions, including:App Marketplace accessWorkflows &gt; DeleteWorkflows &gt; EditWorkflows &gt; EnrollWorkflows &gt; PublishAccount AccessMarketing AccessSales ProfessionalAdd and edit [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2684,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[14],"tags":[],"_links":{"self":[{"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/posts\/2682"}],"collection":[{"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/comments?post=2682"}],"version-history":[{"count":3,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/posts\/2682\/revisions"}],"predecessor-version":[{"id":2688,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/posts\/2682\/revisions\/2688"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/media\/2684"}],"wp:attachment":[{"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/media?parent=2682"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/categories?post=2682"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gogetmuscle.com\/index.php\/wp-json\/wp\/v2\/tags?post=2682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}