OAuth2 redirect_uri can now be served over http if the host is localhost

What’s happening?

Beginning immediately, HubSpot will allow a redirect URI to be served over http in an OAuth2 redirect flow if the host is localhost. This change allows for faster and more lightweight testing with OAuth2, eliminating the need for self-signed certificates. This change is intended for local development and testing; apps in production must continue to serve their redirect URI over https.

When is this happening?

HubSpot will begin allowing http redirect URIs from localhost immediately. All other hosts will continue to require a redirect URI served over https.

Questions? Join the discussion here or contact our support team here.