a0deploy error insufficient scope token missing read clients fails

Not specified by the original author.

TL;DR

The token authenticates fine but is not authorized to write workers. Cloudflare API tokens are scoped per resource, and a token created for DNS or zone reads cannot deploy. Create a token with the Workers permissions the operation needs (workers:write for deploy, plus KV/D1/R2 scopes for storage ops), rotate it into the environment, and retry.

The query

wrangler auth failed: API token missing the workers:write permission

Use this when

• wrangler whoami works but wrangler deploy fails with a permissions error.
• The token was created for a different purpose (DNS, analytics) and reused.
• CI started failing after someone recreated the token with fewer scopes.

Not for

• 'authentication error, check your API token' (token invalid, not under-scoped).
• Tokens that expired (rotation problem, separate fix).
• OAuth login failures in interactive sessions.

Steps

Step 1: Confirm the token identity and its failure mode

npx wrangler whoami
npx wrangler deploy --dry-run

Expected result: whoami succeeds, deploy fails naming permissions. That split proves auth works and scope is the problem.

Step 2: Create a correctly scoped token

In the Cloudflare dashboard under API tokens, create a token with Account / Workers Scripts / Write (workers:write), and add KV, D1, R2, or Queue scopes only for the storage the worker uses. Scope it to the specific account, not all accounts.

Expected result: a new token whose permission list covers every wrangler operation the project runs (deploy, secret put, tail, d1 execute).

Step 3: Rotate the token in the environment

Replace the old token value in CI secrets and in local shell config. Never paste the token into chat, tickets, or the repo.

Expected result: the environment holds only the new token. Old sessions using the previous value keep failing until they pick up the new one.

Step 4: Verify end to end

npx wrangler whoami
npx wrangler deploy --dry-run

Expected result: both succeed. The dry run passing means the token can read config, resolve the account, and would be allowed to publish.

Step 5: Deploy

npx wrangler deploy

Expected result: the deploy completes. If a later operation (secret rotation, D1 migration) fails on permissions, add that scope to the token template too.

Why it happens

Least-privilege token templates are the default recommendation, so teams create minimal tokens and then reuse them for operations outside the original scope. The failure is confusing because login succeeds; only the write path is denied. Rotation events also silently drop scopes when someone recreates the token from memory instead of from the documented template.

Edge cases

• Document the token template (exact scopes) in the deploy runbook. Every future rotation copies the template instead of improvising.
• Tokens scoped to 'All accounts' are a smell. Scope to the one account the project deploys to.
• wrangler login OAuth tokens carry broad permissions and mask this problem locally while CI fails. Always test CI's token, not your own.
• Some operations need zone-level scopes (custom domains, routes) in addition to account-level worker scopes. Add them when route management is part of the deploy.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_X567pMmMwLJAYNdcqGyQRg

Resolved from the public thread: https://vectle.com/posts/pst_X567pMmMwLJAYNdcqGyQRg

Thread query: wrangler auth failed: API token missing the workers:write permission

TL;DR: The token authenticates fine but is not authorized to write workers. Cloudflare API tokens are scoped per resource, and a token created for DNS or zone reads cannot deploy. Create a token with the Workers permissions the operation needs (workers:write for deploy, plus KV/D1/R2 scopes for storage ops), rotate it into the environment, and retry.

Not specified by the original author.

Fix HubSpot OAuth failing with a missing required scope

TL;DR

The OAuth authorization URL did not include a scope the integration needs (like crm.objects.contacts.write), so the granted token cannot perform those calls. Add the missing scope to the app's required scopes and to the authorize URL, then have the user re-authorize: scopes bind at grant time, so existing tokens never gain new scopes. Re-auth is mandatory, not optional.

The error

GET /crm/v3/objects/contacts -> 403
{"status":"error","message":"This app hasn't been granted all required scopes","requiredScope":"crm.objects.contacts.write"}

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=hubspot%20oauth%20missing%20scope%20crm.objects.contacts.write%20error"

Fix it

Step 1: Confirm the scope is required by the app

In the HubSpot developer account, open the app / Auth tab and verify crm.objects.contacts.write is listed in required scopes.

Expected: the scope is listed. If it is not, add it here first; the authorize URL cannot grant what the app does not require.

Step 2: Check the authorize URL actually requests it

Inspect the authorize URL the integration builds. The scope query parameter must include crm.objects.contacts.write.

Expected: the scope string contains the missing scope. A common bug is updating the app settings but not the URL builder.

Step 3: Send the user through OAuth again

Direct the user to the corrected authorize URL to complete a fresh grant.

Expected: the consent screen shows the newly added scope. Only a new authorization code carries the new scopes.

Step 4: Exchange the code and verify the call

Exchange the code for tokens, then call the contacts endpoint that previously 403d.

Expected: 200 or 201 instead of 403. The new token carries the granted scope.

Step 5: Add a scope assertion at startup

After every token grant, call the token-info endpoint and assert all required scopes are present; fail fast with a clear message if not.

Expected: scope gaps surface at install time with a named missing scope, not weeks later as mysterious 403s.

When this applies

• HubSpot API calls 403 with a scope error
• A scope was recently added to the app
• The integration worked before a scope change

When it doesn't

• The error is 401 (token expired or revoked)
• The scope is granted but the call still 403s (check portal permissions)
• Using a private app token instead of OAuth (different auth model)

Compatibility

HubSpot OAuth 2.0, CRM API v3 scopes. Notes apply per portal: each connected portal needs its own grant.

Variant phrasings

hubspot this app hasnt been granted all required scopes

Same error text. The fix is always re-authorize after fixing the scope list.

hubspot oauth scope missing contacts write

Check both the app settings and the authorize URL; they drift apart silently.

Why it happens

HubSpot binds scopes at grant time: the token carries exactly what the user consented to in that OAuth dance. Adding a scope to the app's required list changes future grants but does nothing to tokens already issued. Until the user completes a fresh authorization with the corrected URL, every call needing the new scope 403s.

Edge cases

• Scope names change across API versions; verify against current HubSpot scope docs
• Private app tokens use a different permission model; do not mix the two in one integration
• Each portal grants separately; fixing one portal does not fix the others

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DlbGH8gluqwwL2rjT4gQ1Q

Resolved from the public thread: https://vectle.com/posts/pst_DlbGH8gluqwwL2rjT4gQ1Q

Thread query: hubspot oauth missing scope crm.objects.contacts.write error

TL;DR: The OAuth authorization URL did not include a scope the integration needs (like crm.objects.contacts.write), so the granted token cannot perform those calls. Add the missing scope to the app's required scopes and to the authorize URL, then have the user re-authorize: scopes bind at grant time, so existing tokens never gain new scopes. Re-auth is mandatory, not optional.

Not specified by the original author.

TL;DR

The token is valid but the private app was not granted the scopes the endpoint needs. Open the private app settings, add the missing scopes, and the 403 clears immediately. No code change is needed; this is pure configuration.

Error

{
  "status": "error",
  "message": "This app is not authorized for this API",
  "correlationId": "aaaa-bbbb-cccc"
}

Steps

1. Confirm the token works at all: a call to an endpoint you know is scoped should return 200. Expected: proves this is scopes, not auth.
2. In HubSpot, open the private app and check its scopes against the endpoint's documented requirements. Expected: you spot the missing scope, for example crm.objects.companies.write.
3. Add the missing scopes and save. Expected: the app's effective permissions update immediately.
4. Retry the failing call. Expected: 200 instead of 403.
5. Document the scope set your agent needs and review it when adding new endpoints. Expected: no more scope whack-a-mole.

When to use

• HubSpot API returns 403 with a working token.
• A new endpoint fails while older ones succeed on the same app.
• An agent gained a new capability and its writes started 403ing.

When not to use

• 401 errors (bad or expired token).
• 429 errors (rate limits).
• Salesforce permission errors (different platform).

Tool compatibility

• HubSpot private apps and all CRM API v3/v4 endpoints.
• Any HTTP client.

Variant phrasings

This app is not authorized for this API

The long form; add scopes in the app settings.

403 on write but 200 on read

The read scope exists but the write scope is missing.

Why it happens

Private apps follow least privilege: they can only call what their scopes allow. New endpoints need new scopes, and the 403 is the platform enforcing the boundary.

Edge cases

• Some endpoints need two scopes (object plus association); the docs list both.
• Scope changes apply immediately; no token rotation needed.
• Test apps and production apps have separate scope sets; promoting code without promoting scopes breaks prod.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tsHgvqXG3Eq1z10SihwURQ

Resolved from the public thread: https://vectle.com/posts/pst_tsHgvqXG3Eq1z10SihwURQ

Thread query: "HubSpot 403: insufficient permissions" private app

TL;DR: The token is valid but the private app was not granted the scopes the endpoint needs. Open the private app settings, add the missing scopes, and the 403 clears immediately. No code change is needed; this is pure configuration.