# HubSpot delivery is paused

URL: https://useembers.com/help/troubleshooting/hubspot-delivery-paused/
Category: Troubleshooting
Plan: Solo and above
Updated: 2026-09-12
Last verified: 2026-09-12

> An expired or revoked private-app token, a missing contact scope, or a rejected property stops HubSpot delivery. Here is how to fix and resume it.

HubSpot delivery pauses when the portal returns an error that another attempt cannot fix. The HubSpot card on **Settings**, then **Integrations** (`/settings/integrations`) shows a **Paused** badge and the reason, written either as `HubSpot paused after INVALID_AUTHENTICATION.` or as `HubSpot paused after receiving HTTP 403.`

> **Warning: Solo and above, administrators only**
>
> The Integrations screen requires Solo or above, and only an account administrator can reconnect or resume HubSpot.

## The three causes, in order of likelihood

### 1. The token expired or was revoked

Authentication failures are terminal on the first occurrence. `INVALID_AUTHENTICATION`, `UNAUTHORIZED`, `EXPIRED_AUTHENTICATION`, `invalid_token`, `oauth_invalid`, and any HTTP `401` all pause the install immediately.

The usual causes are a private app that was deleted or rotated in HubSpot, or a portal that was disconnected on the HubSpot side. The fix is a fresh token, not a retry.

### 2. The token is missing a contact scope

A token that authenticates but cannot write contacts returns HTTP `403`, which is also terminal. Embers upserts contacts, so the private app needs **both** `crm.objects.contacts.read` and `crm.objects.contacts.write`. Read-only tokens connect successfully and then pause on the first real lead.

### 3. A property was rejected, or the portal rate limited you

A rejected property value comes back as an HTTP `400` and is terminal, because sending the identical body again produces the identical rejection. Embers only writes `firstname`, `lastname`, `jobtitle`, `company`, `website`, and, on paid plans with a stored value, `email` and `phone`. Empty values are omitted rather than sent as blanks, so a `400` usually means a portal-side validation rule or a property type change.

Rate limits are different. A `429` is retried, along with timeouts and HubSpot server errors: the first attempt plus seven more, from 30 seconds out to roughly 6.3 days. Only if every attempt fails does the install pause, with `HubSpot delivery retries were exhausted.`

## Fix and resume

### Create or repair the private app token

In HubSpot, open your private app and confirm it has contact read and contact write scopes. Copy a current access token.

### Paste the token into Embers

On the HubSpot card, paste the token into **Private app token** and save. Embers validates it against HubSpot before storing it encrypted, so a bad token is rejected at this point rather than at delivery time.

### Send a test

Use the test control. It validates the token and **does not create a HubSpot contact**, so it is safe to run against a live portal.

### Resume

Press **Resume** on the HubSpot card. Your event subscriptions and the master switch are unchanged by a pause, so there is nothing to reconfigure.

### Replay the deliveries you missed

Open the delivery history and retry the rows in a **failed** or **blocked** state. Retries are idempotent: once a delivery has recorded a HubSpot contact id, replaying it updates that contact instead of creating a duplicate.

> **Note: What HubSpot delivery writes**
>
> One contact, created or updated, plus one note on first creation carrying the score, the ICP verdict, and links back to LinkedIn and Embers. No companies and no deals. A report event is recorded as delivered without writing anything.

## If duplicates appeared instead

Embers matches a person to a HubSpot contact by the stored link first, then by searching HubSpot for the email when one exists. A lead with no email on your plan or no email found cannot be matched that way, so a contact you already had under a different address can be created a second time. Merge them in HubSpot: the stored link points at whichever contact Embers wrote.

## Still failing

- The pause reason returns immediately after resuming: the new token still lacks a scope. Check both contact scopes, not just read.
- The card says HubSpot is unavailable for OAuth: private-app connection still works, and it is the supported path.
- You cannot see the Resume button: you are not an account administrator on this account.

Send the pause reason and the time to viraj@useembers.com if it does not clear.

## Related

- [Send leads to HubSpot](/help/integrations/hubspot/): Connect the portal and choose which events write a contact.

- [Slack delivery is paused](/help/troubleshooting/slack-delivery-paused/): The same pause rules on the Slack side.

- [Integrations overview](/help/integrations/overview/): Every destination and the plan each one needs.