# Fix HubSpot delivery when it is paused

URL: https://useembers.com/help/troubleshooting/hubspot-delivery-paused/
Category: Troubleshooting
Plan: Solo and above
Updated: 2026-10-17
Last verified: 2026-10-17

> A rejected or under-scoped token, five refused contacts in a row, or exhausted retries pauses HubSpot delivery. How to read the reason and resume.

HubSpot delivery pauses when the portal returns an error that another attempt cannot fix. The HubSpot page under **Integrations** in the sidebar (`/integrations/hubspot`) then reads "Delivery to HubSpot is paused" at the top, and **Needs attention** under it shows the reason with **Resume**.

> **Warning: Solo and above, administrators only**
>
> The Integrations screen requires Solo or above, and only a workspace admin can reconnect or resume HubSpot. See [what each role can do](/help/reports-and-workspaces/team-and-roles/#what-each-role-can-do).

## Read the pause reason

| Reason | What it means |
| --- | --- |
| `HubSpot paused after INVALID_AUTHENTICATION.` | HubSpot answered 401 or 403. The token was revoked or rotated, or it lacks a contact scope |
| `HubSpot paused after 5 contacts in a row were rejected (last: VALIDATION_ERROR).` | Five leads in a row were refused for their own values, with none synced in between. Usually a portal rule that every lead fails |
| `HubSpot paused after receiving HTTP 404.` (or another 4xx) | HubSpot refused the request for a reason other than one contact's values |
| `HubSpot delivery retries were exhausted.` | Rate limits, timeouts, or HubSpot outages that lasted through every retry |

Authentication errors pause on the first occurrence, because a retry sends the same token. A request HubSpot refuses outright pauses on the first occurrence too, because sending the identical body again produces the identical rejection.

One contact refused for its own values does not pause anything. A `400` `VALIDATION_ERROR` (an invalid email, a value a portal rule rejects), a `409` `CONFLICT` (the contact already exists), or a lead with no properties to write fails that delivery only, and Embers sends the next lead. Only five of those in a row pause the install. One synced contact resets the count. Resuming HubSpot, switching delivery back on, or reconnecting starts the count from zero, so HubSpot pauses again only after five more refused contacts in a row.

If a contact Embers synced is deleted or merged in HubSpot, Embers creates it again (or matches an existing contact by email) on the next update and keeps syncing. HubSpot is not paused. If HubSpot still cannot find the contact, only that lead's delivery fails, and you can choose **Retry** on its row on the **Activity** card.

Rate limits (`429`), timeouts, and `5xx` errors are retried instead: the first attempt plus seven more, from 30 seconds out to about 6.3 days, the same schedule as [webhook retries](/help/integrations/webhook-retries-and-pauses/).

### The token lacks a scope

Embers creates and updates contacts, so the private app needs **both** `crm.objects.contacts.read` and `crm.objects.contacts.write`. Connecting only checks that the token can read the portal, so a read-only token connects and then pauses on the first real lead. HubSpot reports a missing scope as a 403, which is why it shows as `INVALID_AUTHENTICATION` rather than a scope error.

### A property was refused

Embers writes only `firstname`, `lastname`, `jobtitle`, `company`, and `website`, plus `email` and `phone` when a paid plan has them stored. Empty values are left out rather than sent as blanks. Five refused contacts in a row therefore usually point at a validation rule or a changed property type in your portal. The full field list is in [what Embers writes to HubSpot](/help/integrations/hubspot/#what-embers-writes).

## Fix and resume

**Token problem**

### Repair the private app in HubSpot

Open the private app and confirm it has contact read and contact write scopes. Copy a current access token.

### Disconnect, then paste the new token

The connected page has no token field, so open the **...** menu beside the status, choose **Disconnect HubSpot** and confirm, then paste the token into **Private app token** on the **Setup** card and choose **Save token**. Embers checks it against HubSpot before storing it. Saving keeps your event choices and delivery rules and clears the pause, so there is no separate resume.

### Send a test

**Send test**, beside the status at the top of the page, checks the token without creating a HubSpot contact, so it is safe against a live portal.

**Refused property or outage**

### Fix the cause

Relax the portal rule or property type that refused the value, or check HubSpot's status page for an outage.

### Choose Resume

**Resume** appears beside the pause under **Needs attention** while delivery is paused. Your event choices and rules are unchanged by a pause.

## Recover the leads you missed

Leads that qualified while HubSpot was paused were kept as **Blocked**, not sent. After you resume, choose **Retry** on a blocked row on the **Activity** card, or select the leads on the leads list and [send them to HubSpot](/help/leads/send-to-destination/). A pushed lead that already has a linked HubSpot contact is skipped as `already synced to HubSpot contact` unless you tick **ignore rules**, in which case the existing contact is updated rather than duplicated.

## Troubleshooting

- **The pause returns right after reconnecting.** The new token still lacks a scope. Check both contact scopes, not only read.
- **Save token says HubSpot rejected the token.** The token is wrong or revoked: `HubSpot rejected that private app token. Check crm.objects.contacts read and write scopes.` Copy it again from the private app.
- **Duplicate contacts appeared.** A lead without a stored email cannot be matched to an existing contact by email. See [how duplicates are avoided](/help/integrations/hubspot/#how-duplicates-are-avoided), then merge them in HubSpot.
- **Resume is missing.** Delivery is not paused, or you are not a workspace admin.

Send the pause reason and the time to viraj@useembers.com if it does not clear. Slack follows the same pause rules: see [Slack delivery is paused](/help/troubleshooting/slack-delivery-paused/).

## Related

- [Create HubSpot contacts from qualified leads](/help/integrations/hubspot/): Connect the portal and choose which events write a contact.

- [Send a lead to a destination](/help/leads/send-to-destination/): Push the leads you missed during a pause.

- [Fix Slack delivery when it is paused](/help/troubleshooting/slack-delivery-paused/): The same pause rules on the Slack side.

## Frequently asked questions

**Why did HubSpot pause when the token connected fine?**

Connecting only checks that the token can read the portal. A token without the contacts write scope connects, then pauses on the first real lead with INVALID_AUTHENTICATION.

**Do I lose my HubSpot settings if I reconnect with a new token?**

No. Saving a new token keeps your event choices and delivery rules, and it clears the pause at the same time.

**Does a HubSpot rate limit pause delivery?**

No. Rate limits, timeouts, and HubSpot server errors are retried up to seven times over about 6.3 days. Only when every attempt fails does delivery pause.