PipedreamHQ / PipedreamHQ/pipedream
[BUG] HubSpot OAuth regression: default required scope marketing.campaigns.read blocks reauthentication
- Dominant language
- JavaScript
- Stars
- 11.7k
- Forks
- 5.8k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 102
Description
**Describe the bug**
HubSpot reauthentication fails because the OAuth flow requests `marketing.campaigns.read` as a required scope. HubSpot then rejects the authorization with:
`Authorization failed because your account lacks access to the required scopes [marketing.campaigns.read]`
I am a HubSpot Super Admin, and the issue still occurs in an incognito window.
**To Reproduce**
Steps to reproduce the behavior:
1. Start a HubSpot connection / reconnect flow through Pipedream Connect
2. Click to authenticate with HubSpot
3. Complete the HubSpot authorization flow
4. See the OAuth error:
`Authorization failed because your account lacks access to the required scopes [marketing.campaigns.read]`
Additional repro detail:
- The HubSpot authorize URL includes `marketing.campaigns.read` in the required `scope` parameter
- It is not only in `optional_scope`
**Expected behavior**
HubSpot authentication should succeed for portals that do not use campaign-related features.
If `marketing.campaigns.read` is only needed for campaign APIs, it should not be included in the default required scope set for all HubSpot connections.
**Screenshots**
**Additional context**
This appears to be a regression.
Relevant observations:
- I am a HubSpot Super Admin
- The issue persists in incognito, so it does not appear to be a browser/session issue
- The HubSpot authorize URL includes `marketing.campaigns.read` in `scope=...`
- Reviewing the public repo suggests recent campaign support was added:
- `components/hubspot/hubspot.app.mjs` includes `listCampaigns`
- `components/hubspot/actions/list-campaigns/list-campaigns.mjs` exists
Likely root cause:
- The shared HubSpot OAuth app now appears to request `marketing.campaigns.read` by default
- That breaks authentication for HubSpot portals that do not have entitlement to that scope
Suggested fix:
- Remove `marketing.campaigns.read` from the default required HubSpot scopes, or
- Request it only for campaign-related actions/features
Contributor guide
Assessment
This issue has not been assessed yet.