verapli
Sign inJoin free
Menu

Guides · commerce · Popular APIs

HubSpot app (developer platform, legacy private app, Marketplace listing)

Build an app on HubSpot's developer platform with the HubSpot CLI (static auth for one account, OAuth for many), or use a legacy private app token; a Marketplace listing needs OAuth only, three active installs and HubSpot's quality review.

Researched · not yet run liveLast researched 25 October 2026 · HubSpot · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

Apps live in a HubSpot developer account (projects) or, for legacy private apps, in the customer's HubSpot account.

  • HubSpot developer account developeroptionalFor developer-platform apps and Marketplace listings; test in a developer test account.
  • HubSpot account (customer portal) organisationSuper admin needed for legacy private apps.

Have ready

  • Node.js and the HubSpot CLI for developer-platform apps

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Legacy private app token (single account, quickest)optional

    As a super admin go to Development > Legacy apps > Create legacy app > Private; set name, scopes and optional webhooks; Create app; Show token on the Auth tab.

    • verapli co-pilot
    • Human step: You press submit

    verapli captures HUBSPOT_ACCESS_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Calls fail with USER_DOES_NOT_HAVE_PERMISSIONS: The user who created the app was removed; rotate the token or re-add the user. [3]

    Where: https://app.hubspot.com/

  2. Create a developer-platform app with the CLIoptional

    Run hs project create (or hs get-started), choose distribution (private or marketplace) and auth (static or oauth) in app-hsmeta.json, upload to your developer account and test-install in a developer test account.

    • Guided by hand

  3. Copy OAuth client ID and secretoptional

    For oauth apps, copy the client ID and secret from the app's auth settings in the developer account [to verify location].

    • verapli co-pilot
    • After: Create a developer-platform app with the CLI

    verapli captures HUBSPOT_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    Where: https://app.hubspot.com/

  4. Submit a Marketplace listingoptional

    Needs OAuth-only auth, minimal used scopes, and at least three active unaffiliated installs in the past 30 days; submit one app at a time.

    • Guided by hand
    • Human step: The provider reviews it
    • After: Copy OAuth client ID and secret
    The provider says
    Initial review within 10 business days; full review and feedback process no more than 60 days from when feedback is shared. [4]

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Marketplace apps must use OAuth as the sole authorization method and already have three active unaffiliated installs. [4]

Worth knowingThe rules say

Submitting a second app while one is in review gets it automatically rejected. [4]

What you end up with

Env varSecretFormatWhat it is
HUBSPOT_ACCESS_TOKENsecretopaque token stringLegacy private app (or static auth) access token
HUBSPOT_CLIENT_IDnot secretopaque stringOAuth app client ID
HUBSPOT_CLIENT_SECRETsecretopaque stringOAuth app client secret

Renewals

  • Rotate private app access token (HubSpot recommendation): every 6 months [3]

For agents

The same entry as JSON: /api/v1/entries/hubspot/app · requirements /api/v1/requirements/hubspot/app · terms /api/v1/terms/hubspot/app.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for HubSpot app (developer platform, legacy private app, Marketplace listing), and how long will it take?"
  → tools/call requirements { "provider_id": "hubspot/app" }

Sources

  1. Developer platform Apps are created and deployed with the HubSpot CLI (hs project create / hs get-started); configuration uploaded to a project in a developer account; test installs in a developer test account. · accessed 25 October 2026 · official
  2. App configuration Distribution marketplace (requires oauth) or private (allowlisted accounts or single account); auth oauth or static (one account, required scopes only). · accessed 25 October 2026 · official
  3. Legacy private apps Legacy apps still supported; super admin required; Development > Legacy apps > Create legacy app > Private; token on Auth tab; rotate now or with 7-day window; HubSpot recommends rotating every six months; removing the creating user can break calls. · accessed 25 October 2026 · official
  4. App listing requirements in the HubSpot Marketplace At least three active unique unaffiliated production installs with activity in the past 30 days; OAuth as sole auth method; minimal scopes; initial review within 10 business days; full process no more than 60 days from feedback; one submission at a time. · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.316; spotted something out of date? Tell us. HubSpot is not affiliated with verapli.