Understand limits and considerations
The updated install flow only applies to:- Apps that have opted into using the updated install flow early. After April 5, 2026, it will apply to all apps that make changes in the listing editor.
- Apps listed on the HubSpot Marketplace.
- Customers installing the app for the first time. Existing customers who have already installed the app are not affected.
- Installs initiated from the HubSpot Marketplace. Installs initiated from external websites or the app itself are not affected.
- The option of whether customers need to sign in with an external system to authenticate. OAuth authentication itself is not affected.
- The app’s installation process once you publish changes in the listing editor. Until then, the app’s current installation process will not change.
Opt into the updated install flow early
You can choose to switch to the updated install flow from the listing editor. Once in the new flow, you can specify a redirect URL and whether the app will require partner sign in.- If you are using development tools in a standard HubSpot account, navigate to Development. In the left sidebar menu, click App Listings.
- If you are using a legacy developer account, navigate to Marketplace > App Listings.
- Hover over an app, then click the More dropdown menu and select Edit draft.

- In the Listing info section, click Enable seamless install flow.

- In the dialog box, select the checkbox that shows you understand you can’t return to the previous install flow, then click Enable seamless install.
- In the Listing info section of the listing editor, click the Install button URL dropdown menu and select a URL.
- In the Sign-in configuration section, select whether the app will include partner sign in.

Understand the install flow without partner sign in
Developer perspective
Receive installation request
Your install URL endpoint receives a request with these parameters:
code: authorization code for completing the installation.returnUrl: URL used to direct the user back to HubSpot after installation completes. ThereturnUrlwill be added as a query parameter to the end of the Redirect URL selected in the listing editor when HubSpot redirects the customer there.step: always set tofinalize. You do not need to do anything with this parameter.
Complete installation
Once you receive the request, you should:
- Get the
codeandreturnUrlfrom the URL parameters.
- Use the provided
codeto complete token exchange for OAuth. - Store any necessary configuration data associated with the user’s HubSpot account.
Customer perspective
- In your HubSpot account, click the marketplace icon in the top navigation bar, then select HubSpot Marketplace.
- Click an app card.
- In the top left, click Install.
- In the dialog box, review the app’s requirements, then select the checkbox and click Connect app.

- Once the app is installed, you can start using the app:
- Click Explore app features to start from the Feature Discovery section of the app overview page in your Connected Apps settings.
- Click Customize app cards to start customizing the app’s app cards.
- Click the X in the top right to return to the app listing page.

Understand the install flow with partner sign in
Developer perspective
Receive initial installation request
Your install URL endpoint receives a request with these parameters:
step=authorize: indication that this is the initial step in the installation process.returnUrl: URL used to direct the user back to HubSpot after the authentication process completes. ThereturnUrlwill be added as a query parameter to the end of the Redirect URL selected in the listing editor when we redirect the customer there.- Example URL:
Authorize user
- Get the
stepandreturnUrlfrom the URL parameters, then show a login form or page to authenticate the user.
Generate security token
Once the user has authenticated, you should:
- Generate a cryptographically secure, randomized token unique to this user. This is the
statetoken used in future steps. - For example:
Save the `state` token and associate it with the user
- One option is to create a data table without RLS that stores the user’s
uidfrom your system and thestatetoken. - If you are using cookies, tag the cookies with SameSite=none.
- For security, it’s recommended to have a
statetoken with a relatively short expiration window, such as 10 minutes.
Redirect back to HubSpot
- Add the
statetoken you generated in the previous step to thereturnUrlas a query parameter, then redirect the user back to HubSpot. The redirect will look like this:${returnUrl}?state=${state}. Redirecting back to HubSpot is necessary to avoid an infinite login loop. - For example:
Retrieve the user account associated with the `state` token
- Validate that the
statetoken matches the original authentication request. - Retrieve the associated user account.
Finish the process
- If you are able to verify the
statetoken, complete the installation:- Exchange the
codefor OAuth access and refresh tokens. - Redirect the customer to the
returnUrl. Without this step, the user will be stuck in an infinite login loop.
- Exchange the
- If you are not able to verify the
statetoken, do not complete the installation.- Redirect the customer to the
returnUrl. Without this step, the user will be stuck in an infinite login loop.
- Redirect the customer to the
Customer perspective
- In your HubSpot account, click the marketplace icon in the top navigation bar, then select HubSpot Marketplace.
- Click an app card.
- In the top left, click Install.
- In the dialog box, click Sign in to sign up or log in to the app.

- In the new window, finish the app’s sign up / log in process externally.

- After being redirected back to HubSpot, review the app’s requirements, then select the checkbox and click Connect app.

- Once the app is installed, you can start using the app:
- Click Explore app features to start from the Feature Discovery section of the app overview page in your Connected Apps settings.
- Click Customize app cards to start customizing the app’s app cards.
- Click the X in the top right to return the app listing page.

Preview the install flow
Once you have opted into using the new install flow, you can test the installation process from the listing editor before publishing your changes:- If you’re using development tools in a standard HubSpot account, navigate to Development. In the left sidebar menu, click App Listings.
- If you’re using a legacy developer account, navigate to Marketplace > App Listings.
- Hover over an app, then click the More dropdown menu and select Edit draft.
- In the top right, click Preview.
- Run through a test version of the installation process. The test won’t install the app or trigger OAuth authentication.