HubSpot

CRM OAuth, or a service key / private app token you paste Windmill docs

Read and write HubSpot CRM records, lists, marketing content and conversations from any Windmill script, flow or app.

What you can do with HubSpot

Complete, deployable projects built around HubSpot — the fastest way to get something real running.

RevOps lead routing

Import, dedupe, AI-score and route inbound leads every hour, then track time to first touch per rep

Set up in 3 steps

Paste a service key

In HubSpot, open Development → Keys → Service keys (Settings → Integrations → Private apps on older accounts), create a key with the scopes your scripts need, and copy it. Then open Resources, add a hubspot resource, and paste it in the token field.

Or connect with OAuth

If an instance admin has configured HubSpot OAuth, pick hubspot under Instance-configured OAuth APIs and click Connect; the connection acts as you. Scopes beyond the CRM defaults are granted only if the HubSpot app declares them as optional and you tick them on the consent screen.

Run your first script

Fork List CRM Objects, pick contacts in the object type dropdown, and run it before writing anything.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Trigger flows from HubSpot

HubSpot is not only a destination. These inbound paths are supported today.

HubSpot webhooks on an HTTP route

Create a Windmill HTTP route, set it as the target URL in your HubSpot app's webhooks settings, and subscribe to events such as contact.creation; each delivery is a JSON array of events. In the route's script, check X-HubSpot-Signature-v3: the base64 HMAC-SHA256 of method, full URL, raw body and X-HubSpot-Request-Timestamp, keyed with the app's client secret, rejecting timestamps older than 5 minutes.

Workflows can call a route too

On Professional and Enterprise accounts, a workflow's Send a webhook action can POST the enrolled record to a Windmill HTTP route, with no app needed.

Resource type

The shape of the credential every script on this page expects.

hubspot

View raw schema →

Field	Type	Required	What it is
token	string	Yes	Service key or private app access token (pat-...). In HubSpot: Development > Keys > Service keys, or Settings > Integrations > Private apps on accounts that still have them. Filled automatically when you connect with OAuth.

Questions

Service key or OAuth?

A service key (a private app token on older accounts) belongs to the HubSpot account rather than a person, so use it for shared and scheduled flows. Use OAuth for the features that act as a user, such as meeting links and sequence enrollment, which a service key cannot reach.

A call fails on a missing scope

HubSpot answers 403 and names the scopes it would accept. Add the scope to the service key (it keeps the same value), or for OAuth declare it on the HubSpot app, reconnect and tick it. Some scopes, like automation and sequences, need a paid tier.

There is no Connect button on my instance

A Windmill instance admin has to create a HubSpot app and enter its client id and secret once under Instance settings → Auth/OAuth/SAML → OAuth. Until then, paste a service key.

Is my key stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

What you can do with HubSpot

RevOps lead routing

Set up in 3 steps

Paste a service key

Or connect with OAuth

Run your first script

Scripts

Update Thread

Update Page

Update Form

Update CRM Object

Update Blog Post Draft

Update Blog Post

Unarchive Thread

Send Message

Search Lists

Search CRM Objects

Schedule Blog Post

Push Blog Post Draft Live

List Workflows

List Workflow Emails

List Threads

List Templates

List Properties

List Pipelines and Stages

List Pages

List Owners

List Messages

List Meeting Links

List Marketing Events

List Marketing Emails

List Inboxes

List Forms

List Form Submissions

List Custom Object Schemas

List CRM Objects

List Channels