PipedreamHQ / PipedreamHQ/pipedream

[BUG] HubSpot OAuth regression: default required scope marketing.campaigns.read blocks reauthentication

Open
#20,618 0 comments 0 reactions 1 assignee Claimed by @s0s0physm View on GitHub
bug missing scopes triaged
Dominant language
JavaScript
Stars
11.7k
Forks
5.8k
Avg merge
3d 10h
Merged PRs (30d)
102

Description

**Describe the bug**
HubSpot reauthentication fails because the OAuth flow requests `marketing.campaigns.read` as a required scope. HubSpot then rejects the authorization with:

`Authorization failed because your account lacks access to the required scopes [marketing.campaigns.read]`

I am a HubSpot Super Admin, and the issue still occurs in an incognito window.

**To Reproduce**
Steps to reproduce the behavior:

1. Start a HubSpot connection / reconnect flow through Pipedream Connect
2. Click to authenticate with HubSpot
3. Complete the HubSpot authorization flow
4. See the OAuth error:
`Authorization failed because your account lacks access to the required scopes [marketing.campaigns.read]`

Additional repro detail:
- The HubSpot authorize URL includes `marketing.campaigns.read` in the required `scope` parameter
- It is not only in `optional_scope`

**Expected behavior**
HubSpot authentication should succeed for portals that do not use campaign-related features.

If `marketing.campaigns.read` is only needed for campaign APIs, it should not be included in the default required scope set for all HubSpot connections.

**Screenshots**
Image

**Additional context**
This appears to be a regression.

Relevant observations:
- I am a HubSpot Super Admin
- The issue persists in incognito, so it does not appear to be a browser/session issue
- The HubSpot authorize URL includes `marketing.campaigns.read` in `scope=...`
- Reviewing the public repo suggests recent campaign support was added:
- `components/hubspot/hubspot.app.mjs` includes `listCampaigns`
- `components/hubspot/actions/list-campaigns/list-campaigns.mjs` exists

Likely root cause:
- The shared HubSpot OAuth app now appears to request `marketing.campaigns.read` by default
- That breaks authentication for HubSpot portals that do not have entitlement to that scope

Suggested fix:
- Remove `marketing.campaigns.read` from the default required HubSpot scopes, or
- Request it only for campaign-related actions/features

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.