Token setup · 2 minutes
HubSpot has no way for us to ask for access on your behalf, so you create the token yourself. Four steps, read-only scopes. The scan writes nothing.
Settings → Integrations → Private apps → Create a private app.
You need to be a super admin in the portal.
Basic info tab → Name: DealMatching. Nothing else on this tab matters.
Scopes tab → search each one and tick Read only.
crm.objects.contacts.read · crm.objects.companies.read · crm.objects.deals.read · oauth
Create app → Continue creating → Show token → Copy. It starts with pat-.
Open the sample portal instead: 176 records with the same mess a real portal has. You can run the audit and a full sweep on it without a token.
That token is not valid.
The token was revoked, or a character is missing from the paste.
This token is missing a read scope.
Open the private app in HubSpot, tick the scope named in the error, save, paste again.
This looks like an API key.
HubSpot API keys were retired. Create a private app instead — step 1 above.