HubSpot

Trustle reads users, owners, teams, and roles from HubSpot. Trustle can add and remove users, and change their teams and roles.

Prerequisites

• A HubSpot account with the Super Admin permission. Only a Super Admin can create a private app.
• An identity provider connected in Trustle, for example Okta or Microsoft Entra ID. Trustle hides SaaS Applications until one is connected.

Configure HubSpot

Step 1: Create a private app

1. In the HubSpot Development Console, select Legacy Apps from the left menu.

   

2. Click Create Legacy App.

   

3. Select Private.

   

4. Enter a name, for example Trustle.

   

Step 2: Grant permissions

1. Click Scopes, then Add new scope.

   

2. Select each scope:

   Permission	Required	What Trustle does with it
   settings.users.read	Yes	Imports users. Test Connection uses it.
   crm.objects.owners.read	Yes	Imports owners. Without it, the sync fails. Test Connection does not check it.
   settings.users.teams.read	Yes	Imports teams.
   settings.users.roles.read	Yes	Imports roles.
   settings.users.write	Yes	Adds and removes users, and changes their teams and roles.

3. Click Update. Then click Create App and Continue Creating.

Step 3: Collect the values for Trustle

1. Select the Auth tab.

2. In Access Token, click Show token, then Copy.

   

Trustle field	Where to find it in HubSpot	Example
Private App Access Token	Auth tab → Access Token	pat-na1-…

Connect in Trustle

1. In Trustle, go to Connections.
2. Under SaaS Applications, find HubSpot and click Connect.
3. Enter a Connection Name, for example HubSpot production. Description is optional.
4. Enter the value from Step 3.
5. Click Test Connection.
6. After the test passes, click Save Connection.

Note

Test Connection checks that Trustle can sign in. It does not check every permission. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the HubSpot connection.
2. Wait for the first sync to finish.
3. Check that the user count and the team count match HubSpot.

If something is missing, see Troubleshooting.

Caution

A HubSpot user has one role. When Trustle grants a role, it replaces the user’s current role. When that access ends, the user has no role.

Security notes

Note

• Use a dedicated private app for Trustle only.
• Store the access token in a secret manager. Never commit it to a repository.
• If the token leaks, rotate it on the Auth tab. Then paste the new token into the Trustle connection.

Troubleshooting

Test Connection fails

• Access token: copy it again from the Auth tab. It starts with pat-.
• Scope: the app needs settings.users.read.

Test Connection passes, but the sync fails

The app is missing crm.objects.owners.read. Add it in Step 2. Then run the sync again.

Trustle cannot add or remove people

The app is missing settings.users.write. Add it in Step 2.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the HubSpot account ID. Never send a secret, key, or token.