HubSpot MCP Auth Apps: Verification, Distribution, and Write Access for E-commerce

Hey ESHOPMAN community! As experts living and breathing HubSpot and e-commerce, we know that integrating powerful tools into your CRM is key to scaling your business. Lately, there's been a lot of buzz around AI, and many of you are looking to connect custom AI solutions directly into HubSpot. But what happens when you build a cutting-edge AI tool using HubSpot's new MCP Auth App framework, only to hit a wall with verification, distribution, and even fundamental capabilities like write access?

That's exactly the challenge a community member recently grappled with in the HubSpot Community, and their detailed questions sparked a crucial discussion that sheds light on the evolving landscape of HubSpot's app platform. Let's dive into their journey and what we can learn about building and deploying apps on HubSpot today.

Comparison of HubSpot app types and their data access capabilities

The Quest for Verification: MCP Auth Apps and the 'Unverified' Banner

The original poster built an impressive AI tool, connecting it to HubSpot via an MCP Auth App created through the self-service flow. This uses the official Remote MCP Server with OAuth 2.1 + PKCE, which is the modern, secure way to do things. However, they immediately ran into a common developer headache: a banner warning that their app was 'not verified.' This led to a series of pressing questions:

How do MCP Auth Apps become verified, especially since the standard Marketplace listing flow seemed to apply to other app types?
Does the 25-install cap for unlisted apps apply here, and if so, is it per user or per HubSpot account?
What’s the intended path for verification and distribution for these specific apps?

The urgency was palpable, with the poster aiming for a customer launch within a week. This highlights a critical need for clear documentation and pathways from HubSpot for developers leveraging their latest frameworks, especially when building mission-critical tools for e-commerce operations or HubSpot sales and inventory tracking.

Cracking the Code: Verification Path Revealed

While the community moderator worked to gather expert insights, the original poster continued their investigation. They discovered that MCP Auth Apps do appear in the Marketplace listing flow under App Listings. This was a significant clarification, indicating that the standard submission process for verification applies even to these newer app types. This means that developers can indeed submit their MCP Auth Apps for review and eventual verification, removing the 'unverified' banner and allowing for broader distribution beyond initial testing limits.

This discovery is crucial for any developer looking to scale their integration. A verified app not only instills user trust but also unlocks the full potential of distribution through the HubSpot Marketplace, making it accessible to a wider audience of HubSpot users.

Distribution Limits: The 25-Install Cap

The question of the 25-install cap for unlisted apps remained. While not explicitly answered in the thread, general HubSpot app policies suggest that unlisted apps (those not yet verified and publicly listed) typically face distribution limits. For MCP Auth Apps, which use user-level permissions, it's generally understood that these caps apply per HubSpot account installation, not per individual user within an account. This means a single HubSpot portal installing the app counts as one install against the limit, regardless of how many users within that portal connect to it. This is a vital distinction for developers planning their beta testing and soft launches.

The Write Access Dilemma: A Critical Hurdle for E-commerce

Beyond verification, a more fundamental challenge emerged: write access. The community member observed that HubSpot's own first-party connectors (like those for Claude and ChatGPT) had access to manage_crm_objects (write tool) via mcp.hubspot.com. However, their third-party MCP Auth App only received read tools. This limitation is a significant roadblock for many advanced integrations, especially for e-commerce businesses that need to update CRM data based on external events.

Imagine an AI tool designed to update contact properties based on purchase history, or automatically create tasks for sales teams when a customer interacts with a product recommendation engine. Without write access, such capabilities are severely hampered. For effective HubSpot sales and inventory tracking, for instance, an integration might need to update product stock levels in a custom object or adjust deal stages based on order fulfillment. Read-only access simply isn't enough for robust RevOps.

The original poster's question about a timeline for opening write access to third-party MCP Auth Apps highlights a critical need. While HubSpot continuously evolves its platform, developers building sophisticated tools need clear roadmaps for essential functionalities.

Alternative Paths When Write Access is Delayed

Recognizing the potential for delayed write access, the community member wisely explored alternative app creation paths. If third-party write access isn't on the near-term roadmap for MCP Auth Apps, a different approach is necessary for integrations requiring CRM write capabilities. This led to a crucial question about choosing between 'Legacy Apps' and 'Projects' (platform v2025.2+).

The 'Projects' framework is often designed for apps with UI extensions, custom CRM cards, and other in-HubSpot user interface components. For a pure OAuth + API integration with no UI inside HubSpot—where the app primarily interacts with HubSpot's data programmatically—the recommended path is typically a standard Public or Private App (sometimes referred to as 'Legacy Apps' in contrast to 'Projects'). These apps leverage HubSpot's robust REST API and OAuth 2.0 for authentication, allowing developers full control over data read and write operations, provided the necessary scopes are requested and granted.

For e-commerce platforms looking for the best website platform for ecommerce that integrates deeply with HubSpot, understanding these distinctions is paramount. If your custom AI or e-commerce integration needs to:

Update contact lifecycle stages.
Create or modify deals.
Log activities on contact timelines.
Manage custom objects for product data or order fulfillment.

...then building a standard Public/Private App with explicit CRM write scopes and calling the REST API directly is currently the most reliable path for comprehensive functionality. This approach ensures your integration can fully support your RevOps strategy, whether you're augmenting your existing Shopify online store builder or building a custom storefront on HubSpot.

Key Takeaways for HubSpot Developers and Store Operators

This community discussion provides invaluable insights for anyone building on the HubSpot platform:

MCP Auth App Verification: These apps can be verified through the standard Marketplace listing flow, ensuring broader distribution and user trust.
Distribution Limits: Be mindful of the 25-install cap for unlisted apps, which typically applies per HubSpot account.
Write Access for Third-Party MCP Auth Apps: Currently, third-party MCP Auth Apps may be limited to read-only access. Plan your development strategy accordingly.
Choosing the Right App Path: For integrations requiring CRM write access without in-HubSpot UI components, a standard Public/Private App leveraging the REST API is the recommended approach over the 'Projects' framework or a read-only MCP Auth App.

At ESHOPMAN, we understand that seamless integrations are the backbone of a successful e-commerce business. By staying informed about HubSpot's evolving app development landscape, you can ensure your custom tools and AI solutions are built on a solid foundation, ready to power your sales, marketing, and service operations. Always consult the latest HubSpot developer documentation for the most up-to-date guidance.