Why does HubSpot OAuth require super admin access?
So apparently, to set up OAuth access to HubSpot, the integration user has to have SUPER ADMIN ACCESS. Are you kidding me?
To be fair, there is a hacky workaround (an appropriately secured user using a refresh token generated by a Super Admin), but it frequently breaks and only slightly mitigates that absolute compliance nightmare. Least privilege, anyone?
I complained a while back about a vendor demanding admin access to Salesforce just to insert Leads. And now that same integration needs to be recreated for HubSpot. No wonder that vendor is used to ignoring least-privilege security practices, apparently handing out admin access like candy is de rigueur in Hubspot.
This, along with the lack of a server-side code execution environment, pretty much solidifies my assessment: HubSpot is not built for enterprise solutions.
That said, one path Codality is heading down is platform-agnostic solutions that would provide functionality like Quik form population where we'll handle the server-side processing for you. But we can't fix Hubspot's security shortcomings 🤷🏻♀️
Jessie Grenfell
Jessie has spent 20+ years architecting and delivering software for organizations where complexity is the norm — financial services, insurance, nonprofits, and regulated industries where getting it wrong isn't an option. She specializes in the hard problems: unique operational workflows, cross-system integrations, and the kind of compliance requirements (HIPAA, CCPA, SOC 2) that most developers treat as someone else's job.
At Codality, she leads every principal engagement from discovery through delivery — because she's seen what happens when that thread gets cut.