---
title: "HubSpot"
description: "Scoped HubSpot API credentials for AI agents"
url: "https://gazebohq.com/services/hubspot"
---

HubSpot is where sales pipelines, contact records, and marketing workflows live — and AI agents are increasingly the ones updating them. Lead qualification agents, pipeline reporting workflows, and CRM automation tools all need HubSpot API access. Gazebo scopes that access per agent so each one gets only what its task requires.

## Why should AI agents use scoped HubSpot credentials?

A shared HubSpot private app token across agents means any agent can read your entire contact database, update deal stages, or modify marketing workflows. There's no way to know which agent made a change or revoke one agent's access without disrupting the others. Gazebo gives each agent its own named identity and logs every HubSpot credential request.

## How it works

1. Connect your HubSpot account to Gazebo using a private app token scoped to the objects your agents actually need.
2. Create an access profile for each agent role — read-only for reporting agents, write access only for the objects each automation agent touches.
3. Each agent calls get_credential via MCP. Gazebo checks the policy and returns the scoped credential.
4. Every access is logged: which agent, which timestamp, approved or denied.
5. Revoke future HubSpot token retrieval per agent. Revoke or rotate the provider token if a retrieved value may have leaked.

## Use cases

**Lead qualification without full CRM access:** Give your lead qualification agent read access to contact records and deal stages — without exposing the token that can update your entire contact database or modify marketing workflows.

**Pipeline reporting with an audit trail:** Every time a reporting agent retrieves HubSpot credentials, Gazebo logs it. Know exactly which agent pulled which pipeline data and when — separate from HubSpot's own activity log.

**Instant revocation without breaking other integrations:** If a CRM automation agent starts updating records outside its expected scope, revoke its access profile in one click. Your other HubSpot integrations and agents keep running unaffected.