Question: What must the user do to authenticate with OAuth?
- Use a refresh token every few hours, so their app re-establishes a connection with their HubSpot account.
- Submit a temporary authorization code for the integration to access their HubSpot account.
- The user is given an access token they must use whenever they make an API call.
- None of the above. The user only has to read the first authorization screen and permit or deny the integration from accessing their HubSpot account. The rest happens in the backend.
Explanation
The user’s role in OAuth is to review the authorization screen and approve or deny the app’s requested access. After consent is granted, HubSpot redirects back to the app with an authorization code. The app then handles the code exchange for an access token and refresh token on the backend. The user does not manually submit codes or use tokens in API calls. This keeps the authentication flow user-approved while the technical token handling stays inside the integration.
Why the other options are incorrect
Refresh token This is handled by the app after authorization, not manually used by the user.
Authorization code This is passed to the app through the redirect flow, not submitted manually by the user.
Access token This is used by the integration in API requests, not given to the user for manual use.
Source for verification
https://developers.hubspot.com/docs/apps/legacy-apps/authentication/oauth-quickstart-guide
The answer(s) to the question is highlighted in the BOLD text above. You can also find more questions and answers related to the exams on the "Integrating With HubSpot I: Foundations" page.