Weave Code
Hubspot Laravel Package
socialiteproviders/hubspot
HubSpot OAuth2 provider for Laravel Socialite. Adds HubSpot login and OAuth support to socialiteproviders, letting you authenticate users and access HubSpot CRM data with a simple, consistent Socialite driver.
[READ ONLY] Subtree split of the SocialiteProviders/HubSpot Provider (see SocialiteProviders/Providers)
Frequently asked questions about Hubspot
- What is socialiteproviders/hubspot used for?
- It is a Socialite driver that adds HubSpot as an OAuth2 login provider in Laravel applications. You redirect users to HubSpot, handle the callback, and receive a Socialite user object plus an access token you can use against HubSpot APIs. It fits apps that already use Laravel Socialite for server-side redirect and callback authentication. It does not add queues, middleware, or persistence, so it slots in alongside your existing auth flows.
- How do I install socialiteproviders/hubspot with Composer?
- Run composer require socialiteproviders/hubspot. The repository is a read-only subtree split of the SocialiteProviders/Providers monorepo, published as an individual package so you only pull in the provider you need. Do not send pull requests to the split repository; contribute fixes to the main SocialiteProviders/Providers monorepo instead. Installation takes minutes and requires no schema changes or migrations.
- Which PHP, Laravel, and Socialite versions does this provider support?
- The package targets PHP 8.x and Laravel Socialite 5.x on a supported Laravel release, so check the composer.json constraints for the exact range before upgrading. Verify your existing Socialite core version satisfies those constraints, since a mismatch will block installation. Because versioning is package-wide across all SocialiteProviders drivers, a release may bump the version even when only an unrelated provider changed.
- How do I register the HubSpot driver in Laravel?
- Add a listener for SocialiteProviders\Manager\SocialiteWasCalled in your EventServiceProvider and call Socialite::extend with the hubspot driver class inside it, typically via the provider's event handler. Without that listener registration you will get an error such as Driver [hubspot] is not supported. Many apps use the SocialiteProviders\Manager\Providers\HubSpot listener class for this. After registering, Socialite::driver('hubspot') becomes available.
- Where do I put the HubSpot client ID and secret?
- Add a hubspot entry to config/services.php with your client_id, client_secret, and redirect URL, and read those values from environment variables. Use separate HubSpot OAuth apps for local, staging, and production so a callback mismatch in one environment cannot break the others. The redirect URI configured in the HubSpot developer dashboard must match your configured callback route exactly. Credential ownership and rotation should be documented, since the package itself provides no secret management.
- Which HubSpot scopes do I need to read CRM data?
- Scopes depend on which HubSpot objects you touch, for example crm.objects.contacts.read for contacts and crm.objects.companies.read for companies, plus the oauth scope when you need refresh tokens. The provider does not request CRM scopes for you by default, so pass them explicitly when redirecting, for example Socialite::driver('hubspot')->scopes([...]). Request the minimum set you need, because users see the consent screen and can decline broad permissions. Changing scopes may require existing users to re-authorize.
- What changed for HubSpot in version 4.1.3?
- Release 4.1.3 migrated the HubSpot OAuth authorize and token endpoints to HubSpot's 2026-03 endpoints. It is a patch release with no public API changes, no method signature changes, and no configuration key renames, so it is a drop-in for the 4.1.x line. The change is still behaviorally significant: older versions keep working only until HubSpot retires the previous endpoints. If HubSpot login is in use, treat 4.1.3 as a required upgrade rather than an optional one.
- Should I pin an exact version of socialiteproviders/hubspot?
- Pinning an exact version is a reasonable default. The monorepo ships all of its 100-plus providers under one semver, so a caret constraint opts you into changes for drivers you never use. Exact pins make upgrades deliberate and easier to attribute when login breaks. The trade-off is that you must watch vendor deprecation calendars, such as HubSpot's endpoint retirements, yourself instead of relying on the package's release notes.
- How can I test the HubSpot OAuth callback without real users?
- Test the redirect step directly by asserting the authorization URL and the scopes you pass, which needs no live credentials. For the callback, fake the outbound HTTP calls or mock the Socialite driver so the token exchange returns a canned response, then assert your controller creates or logs in the user. A true end-to-end check needs a HubSpot developer test account with a real OAuth app and matching redirect URI. If you have no automated coverage, login success is only observed in production.
- When should I skip this package and write my own driver?
- Skip it if you only need to call HubSpot CRM APIs with a private app token, since that is plain HTTP and needs no OAuth driver. It is also a weak fit for SPAs or mobile apps where PKCE is handled client-side, because Socialite is a server-side redirect and callback flow. If you need heavy customization of HubSpot's OAuth behavior, forking a single provider or extending Socialite's AbstractProvider may be cheaper than adopting the monorepo. It adds the most value when HubSpot login is one of several Socialite providers in an otherwise conventional Laravel app.
Weaver
How can I help you explore Laravel packages today?