HubSpot Auth Oauth
Browse all Hubspot APIs✓ Official Vendor SpecIdentity AuthAuthenticationnone4 EndpointsREST
For Agents
Inspect, refresh, and revoke HubSpot OAuth access and refresh tokens to manage the credential lifecycle for HubSpot integrations.
Use for: I need to refresh an expired HubSpot access token, Get the scopes granted to a HubSpot OAuth access token, Retrieve the portal id encoded in a HubSpot access token, Revoke the refresh token for a deauthorized HubSpot install
Not supported: Does not initiate the OAuth authorization code flow, render consent screens, or read CRM data — use only for inspecting, refreshing, and revoking HubSpot OAuth tokens.
The HubSpot OAuth API covers token introspection and refresh for HubSpot's OAuth 2.0 flow. GET /oauth/v1/access-tokens/{token} returns metadata for an access token including the user, the portal id, and the granted scopes, while GET /oauth/v1/refresh-tokens/{token} returns equivalent metadata for a refresh token. POST /oauth/v1/token completes the standard refresh-token grant to mint a new access token, and DELETE /oauth/v1/refresh-tokens/{token} revokes a refresh token. The endpoints are unauthenticated at the HTTP level because they take the token to inspect or exchange in the path or body.
Install Jentic One Beta
Connect the Auth Oauth to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Auth Oauth, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Auth Oauth API.
Inspect a HubSpot OAuth access token to read user, portal, and scope metadata
Inspect a refresh token to read its expiry and granted scopes
Refresh a HubSpot access token using a refresh token grant
Revoke a refresh token to terminate a HubSpot integration's session
Verify the portal id encoded in a HubSpot OAuth credential before use
Use Cases
Patterns agents use Auth Oauth API for, with concrete tasks.
★ Refresh an expired access token
HubSpot access tokens expire roughly every 30 minutes, so production integrations refresh them on demand. POST /oauth/v1/token with grant_type=refresh_token and the refresh token returns a new access token plus the refresh token's remaining lifetime. The integration stores the new access token and continues making calls.
Call POST /oauth/v1/token with grant_type=refresh_token, the client_id, client_secret, and refresh_token, then store the returned access_token
Verify token scopes before a sensitive call
Before running a destructive workflow, an integration calls GET /oauth/v1/access-tokens/{token} to confirm the scopes attached to the credential. The response includes the user, hub_id, and scopes array, so the integration aborts if a required scope is missing rather than failing midway.
Call GET /oauth/v1/access-tokens/{token} and abort if the scopes array is missing the required crm.objects.contacts.write value
Revoke a refresh token after uninstall
When a customer uninstalls a HubSpot app, the integration must revoke the stored refresh token so it cannot be used again. DELETE /oauth/v1/refresh-tokens/{token} invalidates the token, and a follow-up GET on the same path returns 404, confirming the revocation.
Call DELETE /oauth/v1/refresh-tokens/{token} with the stored refresh token, then GET the same path to confirm a 404 response
Agent integration via Jentic
An auth-management agent can keep HubSpot credentials fresh on behalf of installed apps. Through Jentic the agent searches for the refresh operation, loads the schema, and executes the refresh-token grant. The client secret stays in the Jentic vault and never enters the agent's context.
Search Jentic for 'refresh a hubspot oauth access token', load POST /oauth/v1/token, and execute with grant_type=refresh_token and the stored refresh token
Key Endpoints
4 endpoints — the hubspot oauth api covers token introspection and refresh for hubspot's oauth 2.
METHOD
PATH
DESCRIPTION
GET
/oauth/v1/access-tokens/{token}
Retrieve OAuth access token metadata
GET
/oauth/v1/refresh-tokens/{token}
Retrieve refresh token metadata
DELETE
/oauth/v1/refresh-tokens/{token}
Revoke a refresh token
POST
/oauth/v1/token
Refresh an access token
GET
/oauth/v1/access-tokens/{token}
Retrieve OAuth access token metadata
GET
/oauth/v1/refresh-tokens/{token}
Retrieve refresh token metadata
DELETE
/oauth/v1/refresh-tokens/{token}
Revoke a refresh token
POST
/oauth/v1/token
Refresh an access token
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
OAuth client secrets and refresh tokens are stored encrypted in the Jentic vault. Refresh and introspection calls run through scoped session tokens so the raw secret never enters the agent's context.
Intent-based discovery
Agents search Jentic with intents like 'refresh a hubspot oauth access token' and Jentic returns the matching POST /oauth/v1/token operation with its input schema.
Time to first call
Direct integration: a few hours to wire token storage, refresh-on-expiry logic, and revocation on uninstall. Through Jentic: under an hour — search, load, execute against the four token endpoints.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Auth Oauth API through Jentic.
What authentication does the HubSpot OAuth API use?
The four endpoints do not require a separate Authorization header — the token to be inspected or refreshed is supplied either in the path or in the request body. The refresh endpoint requires the OAuth client_id and client_secret in the body alongside the refresh_token. Through Jentic the client secret stays in the vault.
Can I see which scopes a HubSpot access token has?
Yes. GET /oauth/v1/access-tokens/{token} returns a JSON body that includes the user, hub_id, and scopes array, so an integration can verify the granted permissions before calling endpoints that require specific scopes.
What are the rate limits for the HubSpot OAuth API?
The spec does not declare per-endpoint limits. OAuth endpoints share HubSpot's broader rate limits, but the refresh endpoint should be called only when the access token is near expiry — refreshing on every call is wasteful and can trigger throttling at the account level.
How do I refresh a HubSpot access token through Jentic?
Search Jentic for 'refresh a hubspot oauth access token', load the schema for POST /oauth/v1/token, and execute with grant_type=refresh_token, the client_id, client_secret, and refresh_token. Jentic returns the new access_token and its expires_in value.
How do I revoke a refresh token after a customer uninstalls?
Call DELETE /oauth/v1/refresh-tokens/{token} with the refresh token. The endpoint returns 204 on success and the token is no longer usable. A follow-up GET on the same path returns 404, which confirms the revocation.
Is the HubSpot OAuth API free?
All four endpoints are included with HubSpot's developer platform. There is no per-call charge for token introspection, refresh, or revocation.
GET STARTED