New Granular OAuth Scopes and a Self-Service Migration Tool
Thursday, October 15, 2026
What it is
Granular OAuth scopes are now generally available, replacing the broad files, timeline, tickets and HubDB scopes with precise permissions by resource and action. The Granular Scope Migration Tool, in public beta since September, is now generally available in developer accounts, where developers of legacy public apps and Projects-based marketplace apps can review recommended replacement scopes, customize permissions and migrate on their own timeline. Live, last updated October 15, 2026.
Why it matters
Broad scopes grant several capabilities under one permission, which makes an app's access hard to limit and hard for customers to understand. Granular scopes separate access by object and action, including read, write, delete and publish, and require distinct grants for higher-risk capabilities such as bulk deletion, publishing and high-risk data. Developers request only what the app needs, customers see clearer permissions, and installation friction drops.
The Take
Everything we just read is the reason that it's important to migrate to the new system.
Trisha Merriam picked this one, and Casey and I used most of our energy reading it out loud. The short version: the broad files, timeline, tickets and HubDB OAuth scopes are replaced by granular scopes split by object and action, read, write, delete and publish, with separate grants for sensitive actions like bulk deletion and publishing. The Granular Scope Migration Tool that went to public beta in September is now generally available in developer accounts, for legacy public apps and Projects-based apps distributed through the marketplace.
Here is how I relate it. HubSpot is moving on from the private apps and legacy apps situation, and everything in this description is the reason it is important to migrate: the granular capabilities and the security levels for sensitive data. If you have ever connected Claude or OpenAI to HubSpot and had to check every scope box, you know it is not fun to do more than once, and that is why scopes do not get updated for apps in the marketplace and apps fall behind. This makes it easier to keep an app current.
Trisha's summary is the one to carry: this is for people with apps published in the marketplace. And a self-service migration tool is a phrase I want to mean CRM data moving across systems. It does not, and she had not got her hopes up, because she saw it was for the developer portal.
Who should act: developers of legacy public apps and Projects-based marketplace apps; the tool is in your developer account now. Who can skip it: private apps, privately distributed Projects apps and service keys migrate automatically and cannot use the tool.
Watch Us Discuss This
The full segment from the show, us working through this update start to finish.
FAQ
What changed with OAuth scopes?
Per HubSpot, the broad files, timeline, tickets and HubDB scopes are replaced by granular scopes that separate access by object and action (read, write, delete, publish), with separate grants for sensitive actions like bulk deletion, publishing and high-risk data.
Who uses the migration tool?
Developers of legacy public apps and Projects-based apps using marketplace distribution, in their HubSpot developer account. Private apps, Projects-based apps using private distribution, and service keys migrate automatically and cannot use the tool.
Is this live?
Yes. HubSpot marks it Live, last updated October 15, 2026; the scopes are available across all products and tiers.
Does this move CRM data between systems?
No. Self-service migration here means migrating an app's scopes, not migrating CRM data.
Produced by Value-First Media