**Chat log** from Bead: Hubspot · [canonical source](https://redfish.acequia.io/guerin/.agents/1e0ce614-08fc-41e2-8662-7cc56110f9c2/2026-06-25/chats/2026-06-25-hubspot-api-research.md) · session 2026-06-25 · discussion: Talk: Hubspot *Verbatim chat log: immutable provenance. The bead's copy is ground truth; wiki edits here are a fork, never the record.*
Verbatim user prompts; assistant turns summarized with pointers to the durable notes. Ground truth for this bead.
**Context (pre-bead, from IDE selection carried in):** Stephen flagged a separate, unrelated follow-up — that an "adb workflow should be a new chat" and that a **bead-handoff** should be done (defined in recent chats; possibly a skill in a recent bead; Oscar to document what a handoff should be and add it to `redfish.acequia.io/.ai/skills`, alongside a future cleanup of bead instructions across `.ai/skills`, `redfish.acequia.io/skills`, and bead-specific skills). Marked "may or may not be related." **Not actioned this session** — recorded here so it isn't lost; it is its own future thread, not part of this HubSpot bead.
**User:** > start-bead hubspot > research hubspot api and token/key access **Assistant (summary):** - Read `.ai/START-HERE.md`, `.ai/beads.md`, and the `prepare-new-bead` SKILL to follow the bead protocol. - Generated GUID `1e0ce614-08fc-41e2-8662-7cc56110f9c2`. - Checked for existing HubSpot context: no HubSpot credentials in `.credentials/`, no HubSpot files under `simtable.acequia.io`. Greenfield. - Ran web research (against developers.hubspot.com) on HubSpot's API surface and token/key access model. Full cited brief → [`notes/hubspot-api-and-auth-research.md`](https://redfish.acequia.io/guerin/.agents/1e0ce614-08fc-41e2-8662-7cc56110f9c2/2026-06-25/notes/hubspot-api-and-auth-research.md). - **Key finding / decision:** for a single-account server-side Contacts adapter, use a **Private App access token** (`Authorization: Bearer pat-...`). API keys (`hapikey`) are dead since 2022-11-30; OAuth is only for multi-account/marketplace; Service Keys (public beta since 2026-02-10, no webhooks) are the future migration target. CRM Objects v3 at `https://api.hubapi.com/crm/v3/objects/contacts`; cursor pagination via `paging.next.after`; scopes `crm.objects.contacts.read`/`.write`; private-app rate limits = per-app burst + account-shared daily cap. - Scaffolded the bead: `about.md`, `notes/00-hubspot-orientation.md` (decision + what-to-build + blockers), the research brief, `uploads/README.md`. - Framed the bead against [`bc2bd3b1`](https://redfish.acequia.io/guerin/.agents/bc2bd3b1/) (Simtable Acequia-native CRM replacing Zendesk→HubSpot) and the cloud-auth goes-inta/goes-outa membrane directive (per-cloud: follow-along token how-to + two-legged adapter `.mjs`). - Open questions surfaced to Stephen via an `AskUserQuestion` form (the first two as single-select — a mistake; see below). - Synced bead to canonical URI.
**User (answers to the form):** > Membrane direction = **read and write**. *"why are you not giving me checkboxes? is it not clear in your startup instructions? I often want to add notes in the other field or select multiple and explain why"* > Objects = **Contacts, Companies, Deals, Tickets** (all four). > Next = **draft token how-to AND the adapter .mjs** (both). **Assistant (summary):** - Acknowledged the checkbox correction. The rule was already in durable memory (feedback_open-items-as-checkbox-form: ALWAYS `multiSelect: true`, never radios) — this was a failure to apply it, not a missing instruction. No memory change needed; corrected going forward. - Recorded the resolved decisions in `notes/00-hubspot-orientation.md` (Decisions section) and `about.md` (Session Log). - Built **both** deliverables: - [`skills/mint-hubspot-token/SKILL.md`](https://redfish.acequia.io/guerin/.agents/1e0ce614-08fc-41e2-8662-7cc56110f9c2/2026-06-25/skills/mint-hubspot-token/SKILL.md) — follow-along Super-Admin → Private App mint, read+write scope table for all four objects, credential custody in `.credentials/hubspot-<account>.txt`. - [`artifacts/hubspot-adapter.mjs`](https://redfish.acequia.io/guerin/.agents/1e0ce614-08fc-41e2-8662-7cc56110f9c2/2026-06-25/artifacts/hubspot-adapter.mjs) — two-legged Node adapter (≥18 native fetch). `export`/`read` ingest + `upsert` egress for all four objects; 429 back-off + rate-limit-header self-throttle; contact→CardDAV vCard mapper; token from `$HUBSPOT_TOKEN`/`--token`/`.credentials/hubspot-*.txt`. `node --check` passed (Node v24); not run (no token yet). - **Still blocked on parciante:** which HubSpot account + its Super Admin, and the credential slug. No token = nothing to authenticate against. - Re-synced bead to canonical URI.