A static-token app, and why scopes bite

HubSpot's CLI creates a project, and the project contains a private app with a static token. That token is what the scripts use. It is not the same credential as the CLI's personal access key, and the two carry different scopes.

The 403s

Creating custom properties failed with MISSING_SCOPES when we used the CLI key. The fix was to declare the schema scopes in the app's app-hsmeta.json, upload the project, and use the app's token instead.

"requiredScopes": [
  "crm.objects.contacts.read", "crm.objects.contacts.write",
  "crm.schemas.contacts.read", "crm.schemas.contacts.write",
  "crm.objects.tickets.read",  "crm.objects.tickets.write",
  "forms"
]

Three things worth knowing

• The old tickets scope has been retired. Use crm.objects.tickets.* and crm.schemas.tickets.*.
• Adding a scope does not grant it. Someone has to approve it through the app's reinstall URL, so a scope change always ends with a human click.
• The API error tells you exactly which scopes it wants, in requiredGranularScopes. Read it before guessing.

The token itself lives in a git-ignored .env file, with a committed .env.example showing the shape.