Every claim is tagged: tested, sourced, reported, inferred or unknown. See how

← All guides
Researched guide

HubSpot

Creating a public app in a HubSpot developer account gives you OAuth credentials right away. Review applies only if you list the app in the HubSpot Marketplace.

Tier 2 · Light checks15-30 min hands-onResearched 2026-10-20
DifficultyTier 2 · Light checks

Sourced Using your own app for your own users is self-serve per Composio's guide; Marketplace listing is a separate, reviewed process with install-count requirements. [e1][e2]

Your time (hands-on)15-30 min

Inferred Our estimate. Composio's guide shows only a 3-minute reading time.

Approval wait10 business days to 60 days

Sourced Only for Marketplace listing: HubSpot says its team completes an initial review within 10 business days, and the review/feedback process should take no more than 60 days from when feedback is shared. Not needed for using your own public app with your own users (per Composio's guide, which mentions no review). [e1]

Composio managed authAvailable

Sourced Composio's Hubspot toolkit page lists OAuth2 and API key and says 'Composio-managed OAuth available.' So a developer can connect users without registering their own provider app first; register your own only for your own branding, scopes or rate limits.

Open Composio's toolkit page

Who does what

An agent can

  • Check listing requirements against your plan and draft the checklist.

You must

  • Create the account/app and handle submission.

Steps

  1. Create a HubSpot developer accountYouSourced

    Needed because a public app must be linked to one. [e2]

    Why you: Account creation.

  2. Create a public appYouSourced

    Apps > Create App; fill in name, description, logo, support info. [e2]

    Why you: Needs your signed-in HubSpot session.

  3. Copy credentials and add the redirect URLYouSourced

    On the Auth tab copy client ID and secret; add the redirect URL from your Composio auth config. [e2]

    Why you: Secret must go to your secret store.

  4. Create the Composio auth configYou or agentSourced

    HubSpot > OAuth2 > own developer authentication; paste credentials; base URL https://api.hubapi.com. [e2]

  5. Only if you want a Marketplace listing: submit for reviewYouSourced

    Meet install, security and policy requirements first. [e1]

    Why you: Submission and review back-and-forth are yours.

Requirements

  • Sourced A HubSpot developer account; a public app must be linked to one. [e2]
  • Sourced Marketplace listing needs at least three active installs from unaffiliated production accounts, OAuth as the sole authorization method, and live Terms of Service and Privacy Policy URLs. [e1]
  • Sourced An app meant for installation by multiple HubSpot accounts, or for the Marketplace, must use OAuth. [e3]
  • Sourced The redirect URL must use https in production. [e4]

Scopes and access

  • Sourced A listed app must use all scopes it requests during installation; unused scopes must be removed. [e1]

Review process

  • Sourced Listing submissions are manually reviewed by the HubSpot Ecosystem Quality team; initial review within 10 business days. [e1]

Gotchas

  • Sourced You can only submit one app at a time for Marketplace approval; other submissions made during processing are automatically rejected. [e1]
  • Sourced App name, description, logo and support info are shown to users during authentication. [e2]
  • Sourced Composio's guide uses two different dashboard addresses (platform.composio.dev and dashboard.composio.dev); use whichever your account opens. [e2]

If you get stuck

Sourced Marketplace submission is rejected

Likely cause: Failed a listing criterion, e.g. fewer than three active installs or unused scopes.

Fix: Remove unused scopes, meet install count, ensure live policy URLs, resubmit one app at a time.

Escalate when: Rejected twice with unclear reasons. [e1]

Next actions

  • Create the developer account and public app.
  • Decide whether you actually need a Marketplace listing (reviewed) or only your own users (self-serve).

What was tested

Nothing here has been tested by hand yet.

What we are unsure about

  • HubSpot's OAuth page we read is under the 'legacy apps' path; HubSpot's newer developer platform pages may differ in click paths.
  • The page does not state the access-token lifetime or refresh-token lifetime.
  • Whether a public OAuth app can serve outside customers without Marketplace listing was not answered by any page read; the OAuth page only says OAuth is required for multi-account installs.
  • The wait range is for Marketplace listing only; we converted 10 business days to 14 calendar days.
  • No hands-on test logged yet.

Sources

  1. [e1] HubSpot - App Marketplace listing requirements
    the HubSpot Ecosystem Quality team will complete an initial review within 10 business days.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  2. [e2] Composio - HubSpot OAuth2 credentials
    That's all you need to set up on the HubSpot side.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  3. [e3] HubSpot Developers - Working with OAuth
    Any app designed for installation by multiple HubSpot accounts or listing on the HubSpot Marketplace must use OAuth.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  4. [e4] HubSpot Developers - Working with OAuth
    For security reasons, this URL must use https in production.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  5. [e5] HubSpot Developers - Build apps overview
    legacy [private apps] and [public apps] are still fully supported and actively maintained by HubSpot.
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page
  6. [e6] Composio docs - Hubspot toolkit, Authentication Details
    Composio-managed OAuth available
    retrieved 2026-10-20 · quote check: not yet re-matched against the raw page

Ask this guide

Questions about the ten library providers are answered from the guides, with the passage each answer rests on. For any other app it researches the web live and says so.

About the builder

Built by Moulshree Bhutra

Founding APM at Vudio.ai, applying for APM, Toolkits at Composio (Bangalore). This prototype is my answer to the take-home: a way for a developer to see the cost of an OAuth app before starting, and to trust what they read.

How I approached the problem

  • Started from what already exists. Composio publishes 46 setup guides. I read ten in full: they cover the clicking, but not setup time, difficulty or the approval wait, which is where teams lose weeks.
  • Designed for one decision. A developer asks "should I start this today?" So effort, wait, and what only you can do come first, and the steps come after.
  • Made trust visible. Every claim is tagged tested, sourced, reported, inferred or unknown, and quotes link to the page they came from. Where no provider states a number, the guide says so instead of guessing.
  • Kept the agent honest in code. The live agent cannot mark anything tested, and a quote it cannot find in a page it actually read is removed. The method page lists what was and was not checked.

Why I am a good fit

  • I have owned a product through integrations and AI. At Vudio.ai I worked across three roles as it grew from a video-commerce tool into an AI marketing platform with 10+ modules, including Shopify-connected widgets and the product side of its Campaign agent.
  • Results I can point to. I contributed to about 7x ARR growth ($30K to $0.2M) over two years through 0 to 1 launches. I redesigned Shoppable Widgets and built self-serve onboarding: activation rose about 74% and turnaround fell from 13 days to 4. I led AI Studio from 0 to 1 (ARPU up 5% among fashion brands) and built an analytics dashboard that lifted free-to-paid conversion about 10%.
  • I build to understand. I have a computer science degree and I prototype my own ideas, so I can talk to engineers about trade-offs. Top 3 of 200+ in NextLeap's Product Management Fellowship.
  • I write down what I do not know. This project lists its own gaps, including that the hands-on registrations are still being run.

Find me

Prototype built for the Composio APM, Toolkits take-home. It never asks for credentials or secrets.