@kapa.ai Failure in source: Access denied (403). The authenticated user does not have permissions to access the resource. Verify your scopes: crm.objects.contacts.read, crm.objects.companies.read, crm.objects.leads.read to access stream leads. See details: https://docs.airbyte.com/integrations/sources/hubspot#step-2-configure-the-scopes-for-your-streams-private-app-only

The error you're seeing is a 403 Forbidden error from HubSpot, which means your Private App access token lacks the required OAuth scopes to sync the Leads stream. What's Happening HubSpot enforces scopes for each API call. To access the

leads

stream, your Private App token must have all three of the following scopes: •

crm.objects.contacts.read

•

crm.objects.companies.read

•

crm.objects.leads.read

[HubSpot Destination Troubleshooting] How to Fix It 1. Go to your HubSpot account and navigate to Settings → Integrations → Private Apps. 2. Find the Private App whose access token you're using in Airbyte. 3. Edit the app and add the missing scopes: ◦

crm.objects.contacts.read

◦

crm.objects.companies.read

◦

crm.objects.leads.read

1. Save the changes — HubSpot will generate a new access token. 2. Update your Airbyte HubSpot source configuration with the new access token. In Terraform, the Private App token is configured like this:

resource "airbyte_source_hubspot" "my_source_hubspot" {
  configuration = {
    credentials = {
      private_app = {
        access_token = "...your_updated_access_token..."
      }
    }
    start_date = "2017-01-25T00:00:00Z"
  }
  name         = "...my_name..."
  workspace_id = "..."
}

[Terraform HubSpot Resource] If you're using OAuth instead of a Private App, you may need to reconfigure the OAuth scopes on your OAuth app in HubSpot. The knowledge sources do not contain the full scope configuration steps for OAuth, so refer to the HubSpot OAuth scopes documentation for that case. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.

@kapa.ai All three scopes are being added for Hubspot private app

If all three required scopes (

crm.objects.contacts.read

,

crm.objects.companies.read

,

crm.objects.leads.read

) are already added to your HubSpot Private App, here are a few things to check: 1. Token not updated after adding scopes: When you add or modify scopes on a HubSpot Private App, HubSpot generates a new access token. Make sure you've copied the newly generated token and updated it in your Airbyte source configuration. The old token will not automatically inherit the new scopes. 2. Verify the correct app is being used: Confirm that the Private App whose token is configured in Airbyte is the same one where you added the scopes. 3. 403 error details: The 403 error from HubSpot can occur due to either a missing scope or a missing plan requirement. [Recharge API Permissions] While that reference is for Recharge, HubSpot similarly enforces both scope and plan-level access. [HubSpot Destination Troubleshooting] Unfortunately, the knowledge sources do not contain more detailed troubleshooting steps beyond scope configuration for this specific scenario. If the issue persists after updating the token in Airbyte, I'd recommend: • Double-checking the token in Airbyte matches the latest one from your Private App. • Consulting the HubSpot Private Apps documentation directly for any additional requirements around the

crm.objects.leads.read

scope. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.