HubSpot (developer platform apps with OAuth)

1. 1Decide now whether you will list as an AI connector. If yes, start on platform 2026.09 with isUserLevel: true, because this cannot be changed later
2. 2Create a developer account and a developer test account, then install the CLI and run `hs account auth`
3. 3Run `hs project create` (App, marketplace distribution, oauth) and set redirectUrls plus minimal requiredScopes
4. 4Run `hs project upload`, copy the client ID and secret from the Auth tab, and wire the OAuth callback using the date-based token endpoint
5. 5Sign the AUP via 'Begin publishing', verify your domain, and onboard 3 real customers so you can submit a listing before you near the 25-install cap

App (project component) in a HubSpot developer project, built with the HubSpot CLI and configured in app-hsmeta.json. You create one app in your developer account; it is a component inside a 'project' that you upload with `hs project upload`. Configuration such as the name, distribution (marketplace or private), auth type (oauth or static), redirectUrls and scopes lives in `src/app/app-hsmeta.json` in your repo, not in UI forms. To change redirect URLs or scopes, edit the file and re-upload. Each end user's connection is an install of your app into one HubSpot account (portal). Installs are account-level by default. With `isUserLevel: true` (platform 2026.09), each user installs separately and the app acts with that user's permissions. The UI only shows credentials, distribution, test installs and listings. Legacy public apps (pre-Projects, created in the old 'Apps > Create app' UI) can no longer be created. They go unsupported, with enforcement in September 2027.

This is the authorization-code flow. The authorize URL is https://app.hubspot.com/oauth/authorize with client_id, redirect_uri, scope (space-separated required scopes), optional_scope and state. Exchange the code at the date-based token endpoint (docs show POST https://api.hubspot.com/oauth/2026-09/token; the May 2026 changelog lists /oauth/2026-03/token). The legacy /oauth/v1/token still works but is being deprecated, and new listings must use the v3 endpoints. Access tokens expire after 1800 seconds (30 minutes), so refresh proactively with grant_type=refresh_token. The response's hub_id identifies the connected portal, so store tokens keyed by hub_id (and by user for user-level apps). Optional scopes can be dropped at install, so read the granted scopes from the token response or introspection. Changing required scopes means existing installs must re-authorize. Rotating the client secret (Auth tab > Rotate) invalidates the old secret immediately.

• HubSpot developer account (free) + HubSpot CLIDocumented(2)

  Sign up for an app developer account, install Node.js and `npm install -g @hubspot/cli@latest`, then run `hs account auth`, which uses a personal access key from Development > Keys. The docs require CLI v7.6.0 or later for 2025.2/2026.03 apps and v8.15.0 for 2026.09 user-level apps.

• HTTPS redirect URL on a domainDocumented(2)

  At least one entry in auth.redirectUrls. It must be HTTPS, except that http://localhost is allowed for testing. IP addresses are not supported, so http://127.0.0.1 will fail; use localhost.

• At least one required scopeDocumented(1)

  requiredScopes must contain at least one scope, at minimum the read scope for the object you touch (e.g. crm.objects.contacts.read). OAuth apps can also declare optionalScopes, which the installer can untick and which are dropped if the account lacks the tool. They can also declare conditionallyRequiredScopes, which become required only when you pass them in the install URL's scope parameter. Static-auth apps can only declare required scopes.

• OAuth backend (token exchange + refresh)Documented(1)

  A server that receives the code at your redirect URL, exchanges it with the client secret, stores refresh tokens per hub_id, and refreshes access tokens every ~30 minutes. HubSpot's oauth-quickstart-nodejs sample works with http://localhost:3000/oauth-callback.

• Signed Acceptable Use PolicyDocumented(1)

  Marketplace-distribution apps: on the Distribution tab, click 'Begin publishing' and sign the AUP before any non-test account can install.

• Verified domain (recommended)Documented(1)

  Development > Domain > Verify a domain, then add a DNS TXT record. This replaces the scary 'unverified app' install warning with your domain name, though a 'not reviewed by HubSpot' banner remains until listing. Only one verified domain is allowed per developer account.

• 3 active, unaffiliated production installsDocumented(1)

  These are needed before you can submit a listing. Active means successful OAuth-authenticated API calls, signed webhook requests or extension requests in the past 30 days, from HubSpot production accounts not affiliated with your organization. Test accounts and your own portals do not count.

• Public listing assetsDocumented(1)

  Live, crawlable URLs for: integration-specific setup documentation, privacy policy, terms of service, a support site and an install button URL. You also need pricing that matches your website and an accurate 'Shared data' table matching your scopes. Allowlist the 'HubSpot Crawler' user agent so URL checks do not fail.

• Technology Partner Program AgreementDocumented(1)

  Accept HubSpot's Technology Partner Program Agreement as part of listing.

• User-level access or HubSpot MCP server (AI connectors)Documented(2)

  If your app primarily connects HubSpot to external generative-AI tools, the listing rules say it must require user-level permissions (isUserLevel: true, platformVersion 2026.09) or be built with HubSpot's remote MCP server. This has to be decided before you create the app, because account-level apps cannot be migrated to user-level.

• Supported platform version and OAuth v3 endpointsDocumented(1)

  From Nov 2, 2026, new listings must be on developer platform v2025.2 or v2026.03 per the changelog (2026.09 is the newest version). New listings and certifications must use the date-based OAuth v3 token endpoints, not /oauth/v1.

• Certification: 6 months listed, 60 active installs, demo video, security questionnaire, uninstall endpointDocumented(2)

  Submit a YouTube demo video of at least 3 minutes that shows install, setup, use, disconnect and uninstall. Keep an API success rate above 95%, use DELETE /appinstalls/v3/external-install, and complete the token storage security questionnaire.

1. 1

   Create a HubSpot developer account and a developer test account

   About 10–20 min

   You do this

   This needs account sign-up and your HubSpot login, which an agent must not do for you.

   1. Sign up for a free app developer account at developers.hubspot.com (Get started / create a developer account).
   2. In the developer account, navigate to Development, then Test accounts, and click 'Create developer test account'. Follow the prompts.
   3. Test accounts are where you install and exercise the app without spending one of your 25 (or 10) production installs.
   Documented(1)Create an app (prerequisites and test accounts)Account typesPointer ready: highlights “Development”
2. 2

   Install and authenticate the HubSpot CLI

   About 10–20 min

   Agent prepares, you submit

   An agent can run the npm install. You must generate the personal access key in the browser and paste it into `hs account auth`.

   1. Run `npm install -g @hubspot/cli@latest` (v7.6.0+ required; v8.15.0+ if you want user-level access on 2026.09).
   2. Run `hs account auth`. It opens HubSpot to generate a personal access key (Development > Keys > Personal access key). Copy the key back into the terminal.
   3. Confirm with `hs account list`.

   Install command

   npm install -g @hubspot/cli@latestCopy

   Auth command

   hs account authCopy

   Documented(1)Install the CLIManage keysPointer ready: highlights “Keys”
3. 3

   Decide distribution, auth type and user-level vs account-level BEFORE creating the app

   About 15–45 min

   Agent prepares, you submit

   An agent can lay out the tradeoffs. You decide, because this choice is hard or impossible to change later.

   1. Distribution: choose 'marketplace' if you want any customer to connect (25-install cap until listed). Choose 'private' for up to 10 allowlisted portals. You can switch private to marketplace later without breaking installs.
   2. Auth: choose 'oauth' for multi-account connections. 'static' is for a single account only.
   3. If your product is an AI agent or connector that brings HubSpot data into an LLM and you intend to list, plan for user-level access: set platformVersion 2026.09 in hsproject.json and isUserLevel: true in app-hsmeta.json. User-level apps do not support webhooks, app cards, serverless functions or custom workflow actions, and only some APIs work (CRM objects broadly do; bulk associations and some others do not).
   4. Existing account-level apps cannot be converted to user-level. You would need a new app (new client ID), and every customer would have to reconnect.

   hsproject.json platformVersion

   2026.09Copy

   Required for isUserLevel

   app-hsmeta.json config.isUserLevel

   trueCopy

   Only if you choose user-level access

   Documented(2)User-level accessListing requirements (AI connectors)
4. 4

   Scaffold the app with `hs project create`

   About 15–30 min

   An agent can do this

   This is purely local CLI and file editing once the CLI is authenticated. An agent can run it end to end.

   1. Run `hs project create`. When asked for the base contents, select App.
   2. At the prompts choose --distribution (marketplace or private), --auth (oauth), and any --features (Card, App Function, Settings, Webhooks, Custom Workflow Action). Pick none if you only need API access.
   3. In src/app/app-hsmeta.json, set a unique `uid` (do not change it after the first upload), the app `name`, `description` and `support` contact details.

   Command

   hs project createCopy

   Documented(1)Create a new app using the CLIApp configuration reference
5. 5

   Configure redirect URLs and scopes in app-hsmeta.json

   About 20–60 min

   An agent can do this

   An agent can write the JSON. You should confirm the production callback domain and the minimal scope list.

   1. Set auth.type to "oauth".
   2. Add redirectUrls. Each must be HTTPS except http://localhost, and it must be a domain, not an IP address. Include both your local dev callback and your production callback.
   3. Put scopes every customer must grant in requiredScopes (at least one). Put scopes only some customers can grant (e.g. Enterprise-only tools) in optionalScopes. Put scopes you request per install via the install URL's scope parameter in conditionallyRequiredScopes.
   4. Request only scopes you actually use. Unused scopes are a listing rejection reason and must also appear in the listing's Shared data table.

   auth.type

   oauthCopy

   auth.redirectUrls

   ["http://localhost:3000/oauth-callback", "https://YOUR_DOMAIN/oauth/hubspot/callback"]Copy

   auth.requiredScopes

   ["crm.objects.contacts.read"]Copy

   Example; add only what your agent uses

   auth.optionalScopes

   []Copy

   auth.conditionallyRequiredScopes

   []Copy

   Documented(1)App configuration: authenticationScopes reference
6. 6

   Upload the project and copy the client ID and secret

   About 10–20 min

   Agent prepares, you submit

   An agent can run `hs project upload`. Copying the secret from the Auth tab needs your logged-in browser.

   1. Run `hs project upload`. This builds and deploys the project.
   2. Run `hs project open` (or go to Development > Projects and click your project name).
   3. Under Project Components, click your app's name, then click the Auth tab.
   4. Under Client credentials, copy the Client ID and Client secret into your backend's secret store. Redirect URLs are listed at the bottom of this tab.
   5. If the secret leaks, click Rotate next to it, then 'Rotate secret'.

   Commands

   hs project upload && hs project openCopy

   Documented(1)Locate client credentialsPointer ready: highlights “Projects”
7. 7

   Implement the OAuth flow and token refresh

   About 1–4 hours

   An agent can do this

   This is code. An agent can write and test it against a developer test account.

   1. Build the authorize URL: https://app.hubspot.com/oauth/authorize?client_id=...&redirect_uri=...&scope=<space-separated required scopes>&optional_scope=<optional>&state=<csrf>. The scope parameter must include every required scope, or the authorization page shows an error.
   2. On callback, verify state, then POST (form-encoded) code, redirect_uri, client_id, client_secret and grant_type=authorization_code to the date-based token endpoint (docs: https://api.hubspot.com/oauth/2026-09/token). Avoid /oauth/v1/token for anything you plan to list.
   3. Store refresh_token keyed by hub_id (and by user for user-level apps). Treat access tokens as valid for expires_in seconds (1800) and refresh with grant_type=refresh_token shortly before expiry.
   4. Read the granted scopes from the token response or introspection, because optional scopes may be missing.
   5. Implement uninstall using DELETE /appinstalls/v3/external-install. This is required for certification.

   Authorize URL

   https://app.hubspot.com/oauth/authorizeCopy

   Token URL

   https://api.hubspot.com/oauth/2026-09/tokenCopy

   The May 2026 changelog lists /oauth/2026-03/token; use the version your docs page shows

   Access token lifetime

   1800 secondsCopy

   Documented(3)Working with OAuthManage OAuth tokens (latest API)OAuth quickstart (Node.js)
8. 8

   Install in a developer test account

   About 10–20 min

   You do this

   This needs your HubSpot login to click through the consent screen.

   1. Go to Development > Projects, click your project, then click your app's UID in the component list.
   2. On the Distribution tab, next to Test installs, click 'Add test install(s)'.
   3. In the right panel, click Install next to your test account.
   4. Review the permissions, select the checkbox to authorize installing an unverified app, then click 'Connect app'.
   5. Confirm that your backend received the code and stored tokens, then run `hs project dev` for local development.
   Documented(1)Install in a developer test accountPointer ready: highlights “Distribution”
9. 9

   Private distribution: add approved accounts

   About 5–15 min

   You do this

   This uses your logged-in session, and only accounts your HubSpot user can access are offered.

   1. On the app's Distribution tab, click 'Add approved account(s)'.
   2. Under 'Other production accounts', select the checkbox for each account (max 10), then click 'Save changes'.
   3. Hover an approved account to copy its install link, and send that link to the customer's admin.
   Documented(1)Install a privately distributed OAuth appPointer ready: highlights “Distribution”
10. 10

    Marketplace distribution: sign the AUP and get the install URL

    About 10–20 min

    You do this

    This is a legal attestation (Acceptable Use Policy) that must be accepted by a human.

    1. On the app's Distribution tab, click 'Begin publishing'.
    2. Review and sign the Acceptable Use Policy. You can close the panel and return later via 'Continue publishing'.
    3. Copy the sample install URL into your agent's 'Connect HubSpot' button. No allowlist applies, but installs cap at 25 until listed.
    4. Tell early customers to expect an unverified-app warning. They must click 'Connect app', type 'I accept the risk', then click Connect.
    Documented(1)Install an OAuth marketplace appPointer ready: highlights “Distribution”
11. 11

    Verify your domain to soften the install warning

    About 15–60 min

    Agent prepares, you submit

    You start it in HubSpot. An agent with DNS API access can add the TXT record.

    1. Go to Development > Domain and click 'Verify a domain'.
    2. Enter your domain and click Next, then add the TXT record (Host (name) and Value) at your DNS provider and click Next.
    3. Verification usually completes within an hour but can take up to 48 hours. Only one verified domain is allowed per developer account.
    Documented(1)Verified domainsPointer ready: highlights “Domain”
12. 12

    Create and submit the Marketplace listing

    About 1–3 days

    Agent prepares, you submit

    An agent can draft the listing copy, setup guide, Shared data table and pricing text. You must log in, accept the partner agreement and submit.

    1. Confirm you have 3 active, unaffiliated production installs with successful API calls in the last 30 days.
    2. Go to Development and click 'App Listings' in the left sidebar. In the upper right, click 'Create listing', select your app and click Next, then choose the primary listing language and click Next.
    3. Complete all seven tabs: Listing info, App details, Pricing, App features, Support info, Testing info, Review info. Since March 31, 2026 test credentials are no longer required; provide a demo video or walkthrough instead.
    4. Make sure every URL is live and crawlable, and allowlist the 'HubSpot Crawler' user agent. Add an integration-specific setup guide, privacy policy and terms. Make Shared data match your scopes, marking objects with read+write scopes as bi-directional.
    5. Submit. Only one app can be in review at a time, and extra submissions are auto-rejected. Expect initial feedback within 10 business days.
    Documented(2)Listing your appListing requirementsSetup guide requirementsPointer ready: highlights “App Listings”
13. 13

    Apply for certification (optional, later)

    About 1–3 days

    Agent prepares, you submit

    An agent can script the demo and fill in the questionnaire drafts. You record the video and submit.

    1. Wait until the app has been listed for 6+ months and has 60+ active installs. The 'Certify app' option only appears when you are eligible.
    2. Record a demo video of at least 3 minutes (YouTube URL) covering install, setup, core use, disconnect and uninstall. Promotional videos are rejected.
    3. Go to Development > App Listings, hover over the app, click More, then select 'Certify app'. Paste the video URL and click 'Submit certification application'.
    4. Complete the OAuth token storage security questionnaire, and confirm the app uses the uninstall endpoint and a supported platform/API version.
    Documented(1)Applying for certificationCertification requirementsPointer ready: highlights “App Listings”
14. 14

    Alternative: create a service key for single-account access

    About 5–15 min

    You do this

    Requires your HubSpot login, and the key is a secret you must handle yourself.

    1. In your HubSpot account, go to Development > Keys > Service keys and click 'Create service key'.
    2. Enter a name, click 'Add new scope', tick the scopes you need (use 'Find a scope' to search), click Update, then click Create and confirm.
    3. Open the key, click Show, then Copy, and send it as a Bearer token. Optionally turn on Automatic rotation (every 3, 6 or 12 months).
    Documented(1)Service keysPointer ready: highlights “Service keys”

• Can't find 'Create app' / tutorial shows old Apps UIDocumented(2)

  You'll see: Older tutorials say to go to Apps > Create app > Auth tab and tick scopes. That button is missing, or creating a public app is blocked.

  Do this: Legacy public app creation was disabled on May 26, 2026 (new accounts) and June 23, 2026 (existing accounts). Use `hs project create` and configure auth in app-hsmeta.json instead.

• Installs stop at 25Documented(2)

  You'll see: New customers cannot install the marketplace-distribution app after the 25th account.

  Do this: Get 3 active installs and submit a Marketplace listing. The cap lifts automatically on approval. In the meantime, uninstall stale or internal portals; developer test accounts do not count. HubSpot reportedly does not raise the cap on request (community).

• AI connector listing rejected for account-level accessDocumented(2)

  You'll see: A reviewer flags that your app is an AI connector without user-level permissions or the HubSpot MCP server.

  Do this: Create a NEW app on platform 2026.09 with isUserLevel: true, or build on the HubSpot remote MCP server; account-level apps cannot be converted. Customers will need to reconnect. Decide this up front.

• Redirect URL rejected / redirect_uri mismatchDocumented(1)

  You'll see: An error on the authorize page, or token exchange fails for http://127.0.0.1 or a non-HTTPS URL.

  Do this: Use https in production and http://localhost (not 127.0.0.1) for local testing. Add the exact URL to auth.redirectUrls, run `hs project upload`, and send the same redirect_uri in the authorize and token calls.

• Authorize page error about scopes / install fails on lower-tier portalsDocumented(1)

  You'll see: Users see a scope error, or cannot install because their account lacks a tool such as an Enterprise-only feature.

  Do this: Make the scope parameter include every requiredScope. Move tier-dependent scopes to optionalScopes (passed as optional_scope) or conditionallyRequiredScopes, then check the granted scopes in the token.

• Customer user cannot install the appDocumented(1)

  You'll see: A customer user gets a permissions error when connecting.

  Do this: The installer must be a Super admin, or have the 'HubSpot Marketplace access' permission plus permissions matching your requested scopes. Ask the customer's admin to install.

• Listing submission rejected or stuck in DraftDocumented(1)

  You'll see: Rejection for dead URLs, generic product copy, mismatched pricing, unused scopes or a second app submitted while one is in review.

  Do this: Allowlist 'HubSpot Crawler'. Write integration-specific copy and a setup guide. Match pricing to your site. Remove unused scopes. Submit one app at a time.

• Listing rejected for unsupported platform version or OAuth v1Documented(1)

  You'll see: After Nov 2, 2026, the new listing is rejected because the app is legacy or on Projects 2023.2/2025.1, or uses /oauth/v1/token.

  Do this: Migrate to a supported platform version (2025.2, 2026.03, or the latest 2026.09) and switch to the date-based /oauth/<version>/token endpoints.

• Expired access token (401) after 30 minutesDocumented(1)

  You'll see: API calls start failing about 30 minutes after connect.

  Do this: Refresh with grant_type=refresh_token before expires_in elapses, and serialize refreshes per hub_id.

• CorrectedIs creating a public app in the developer account UI (Apps > Create app) still the way to start?No. The Apr 23, 2026 changelog disabled legacy public app creation from May 26, 2026 (new accounts) and June 23, 2026 (existing accounts). New apps must be CLI projects (`hs project create`). Legacy public apps go unsupported, with enforcement in September 2027.Read against official docs, 2026-10-30
• ConfirmedInstall limit for unlisted public apps (commonly cited as 25)Confirmed: 25 installs for marketplace-distribution OAuth apps before listing, excluding developer test accounts (Manage apps page). It is enforced for apps created on or migrated to 2025.2+ since Sept 22, 2025. Private distribution allows 10 allowlisted accounts, and static/service keys are single-account.Read against official docs, 2026-10-30
• ConfirmedMinimum installs required before a Marketplace listing3 active, unique installs from unaffiliated production accounts with successful activity in the past 30 days. Listing review: initial review within 10 business days, and the whole process no more than 60 days from feedback.Read against official docs, 2026-10-30
• CorrectedCan AI-agent apps list with ordinary account-level OAuth?The listing requirements (last modified Oct 15, 2026) say AI connectors must use user-level access or HubSpot's MCP server. User-level needs platform 2026.09, cannot be retrofitted onto account-level apps, and drops webhooks, app cards, serverless functions and workflow actions.Read against official docs, 2026-10-30
• CorrectedPrivate app as the single-portal alternativeAdvice to 'just create a private app in Settings > Integrations > Private Apps' is outdated. Legacy private app creation was disabled Sept 28, 2026 (new accounts) and Oct 26, 2026 (existing accounts). HubSpot now points to Service Keys (Development > Keys > Service keys) or static-auth project apps.Read against official docs, 2026-10-30
• CorrectedOAuth token endpoint for new listingsMost tutorials use POST https://api.hubapi.com/oauth/v1/token. The May 7, 2026 changelog requires the date-based OAuth v3 endpoints for new listings and certifications and says v1 is being deprecated. The latest docs show /oauth/2026-09/token.Read against official docs, 2026-10-30
• ConfirmedAccess token lifetimeexpires_in is 1800 seconds (30 minutes) in the official quickstart and token examples, and in HubSpot's developer blog.Read against official docs, 2026-10-30
• ConfirmedRedirect URL rulesHTTPS is required, http://localhost is allowed for testing, and IP addresses are not supported. URLs are configured in app-hsmeta.json redirectUrls and shown at the bottom of the Auth tab.Read against official docs, 2026-10-30
• CorrectedTest credentials required in listing submissionsSince March 31, 2026, test credentials are no longer required for listing submissions. Demo videos or guided walkthroughs replace them, although the wizard still has a 'Testing info' tab.Read against official docs, 2026-10-30
• Couldn't verifyCertification review timelineThe certification pages list eligibility (6 months listed, 60 active installs, demo video of at least 3 minutes) but give no review duration.Read against official docs, 2026-10-30
• ConfirmedAutomated: developer console (https://app.hubspot.com/developer)Loaded: "Developers | HubSpot".Live HTTP probe, 2026-10-30
• ConfirmedAutomated: authorize endpoint with a fake client_id (https://app.hubspot.com/oauth/authorize)Endpoint answered HTTP 200 ("HubSpot OAuth").Live HTTP probe, 2026-10-30
• ConfirmedAutomated: 43 quotes re-fetched and matched against their cited pages43 of 43 quotes found verbatim in the live page HTML. 17/18 source URLs returned HTTP 200.Read against official docs, 2026-10-30

• HubSpot publishes no turnaround time for certification review.
• Real-world listing approval times were not sampled from the community. The 2-10 week range is derived only from HubSpot's '10 business days' initial review and '60 days' feedback window.
• The Nov 2, 2026 listing rule names v2025.2 and v2026.03 as supported. That 2026.09 (the latest, needed for user-level access) is also accepted is inferred, not stated in that changelog.
• The exact token endpoint path differs across official pages (/oauth/2026-03/token in the May 2026 changelog vs /oauth/2026-09/token on the latest token docs). Use whichever version your platform/API version supports.
• Refresh-token lifetime (whether refresh tokens expire on their own) was not stated on the pages reviewed.
• The 'Solutions Partner: 100 private installs' override comes from the Sept 2025 changelog. The current Manage apps page states only 10.
• Console URL paths under app.hubspot.com (developer projects, app listings) were not confirmed, so pointer urlPatterns match any app.hubspot.com page (including EU app-eu1). No console walkthrough was done.
• Whether HubSpot ever grants exceptions to the 25-install cap is community-reported only.
• What exactly counts as an 'AI connector' for the user-level/MCP rule is decided by HubSpot reviewers.

1. s1Create a new app using the CLI (official docs, accessed 2026-10-30)
2. s2App configuration (official docs, accessed 2026-10-30)
3. s3Manage apps in HubSpot (official docs, accessed 2026-10-30)
4. s4App listing requirements in the HubSpot Marketplace (official policy, accessed 2026-10-30)
5. s5New marketplace distribution app install limits (changelog) (official blog, accessed 2026-10-30)
6. s6App Listing and App Certification Requirement Updates for May 2026 (changelog) (official blog, accessed 2026-10-30)
7. s7Legacy Public App Creation Sunset (changelog) (official blog, accessed 2026-10-30)
8. s8Legacy Private App Creation Being Disabled (changelog) (official blog, accessed 2026-10-30)
9. s9Legacy APIs and Apps: What's Going Unsupported and When (changelog) (official blog, accessed 2026-10-30)
10. s10Working with OAuth (official docs, accessed 2026-10-30)
11. s11Production-Ready OAuth Token Management for HubSpot Integrations (official blog, accessed 2026-10-30)
12. s12Configure user-level access for an app (official docs, accessed 2026-10-30)
13. s13Make API requests using a service key (official docs, accessed 2026-10-30)
14. s14Applying for app certification (official docs, accessed 2026-10-30)
15. s15Developer platform and API versioning (official docs, accessed 2026-10-30)
16. s16HubSpot Marketplace | Listing your app (official docs, accessed 2026-10-30)
17. s17Determine your migration path (official docs, accessed 2026-10-30)
18. s18New Marketplace Distribution App Install Limits (community thread) (community, accessed 2026-10-30)
19. p1Live probe (console): Loaded: "Developers | HubSpot". (probe, accessed 2026-10-30)
20. p2Live probe (authorize-endpoint): Endpoint answered HTTP 200 ("HubSpot OAuth"). (probe, accessed 2026-10-30)