Permissions Reference

This page details the permissions required for different users to install, configure, and use the QuickBooks Invoicing integration.

Permission Levels Overview

The integration requires different HubSpot permission levels for different tasks:

HubSpot Permission Requirements

Super Admin Permissions

Required for:

• Installing the app from HubSpot Marketplace
• Approving OAuth scopes during installation
• Accessing the settings page
• Configuring QuickBooks OAuth credentials
• Connecting and disconnecting QuickBooks
• Configuring default settings (tax codes, products)
• Uninstalling the app

Why Super Admin is required:

• App installation affects entire HubSpot account (all users)
• OAuth scopes grant data access permissions
• Settings affect all users who create invoices
• Security: Only admins can configure integrations

How to check if you’re a Super Admin:

1. Go to Settings (gear icon) → Users & Teams
2. Find your user account
3. Check if role is Super Admin

If you’re not a Super Admin:

• Contact your HubSpot administrator
• Request Super Admin permissions temporarily for installation
• Or have a Super Admin install the app for you

Deal Access Permissions

Required for:

• Viewing the QuickBooks Invoices card on deal records
• Viewing invoice creation history
• Seeing connection status

Minimum permission level: View deals

How to check deal permissions:

1. Go to Settings → Users & Teams
2. Find your user account
3. Check CRM permissions → Deals
4. Should show at least “View” access

Deal Edit Permissions

Required for:

• Creating invoices from deals
• Sending invoice emails
• Scheduling invoice sends
• Selecting invoice types (Deposit, Follow-up, Final)

Minimum permission level: Edit deals

Why edit permission is needed:

• Creating invoices is considered a modification action
• Ensures only authorized users can generate invoices
• Prevents unauthorized invoice creation

How to check edit permissions:

1. Go to Settings → Users & Teams
2. Find your user account
3. Check CRM permissions → Deals
4. Should show “Edit” or “Edit and delete” access

QuickBooks Permission Requirements

QuickBooks Company Admin

Required for:

• Authorizing the integration during OAuth flow
• Granting permissions to create invoices and customers
• Accessing QuickBooks company during connection

Why QuickBooks Admin is required:

• Only admins can authorize third-party apps
• Integration needs permission to create invoices and customers
• Security: Only company owners/admins can grant API access

How to check if you’re a QuickBooks Admin:

1. Sign in to QuickBooks Online
2. Go to Settings (gear icon) → Manage Users
3. Find your user account
4. Role should be Company Admin or Primary Admin

If you’re not a QuickBooks Admin:

• Contact your QuickBooks company administrator
• Request access to authorize the integration
• Or have an admin complete the OAuth connection

QuickBooks User Roles

After the integration is connected (by an admin), the integration operates under its own OAuth credentials. Individual QuickBooks user permissions don’t affect the integration’s ability to create invoices.

Integration has permissions to:

• Create invoices
• Create customers
• Read tax codes
• Read products/services
• Send invoice emails (via QuickBooks)

These permissions are granted during the OAuth authorization and are independent of individual user roles.

Intuit Developer Portal Permissions

Developer Account Owner

Required for:

• Creating a QuickBooks app in Intuit Developer Portal
• Accessing app credentials (Client ID and Secret)
• Configuring OAuth redirect URIs
• Generating production keys

How to become a developer:

1. Sign up at developer.intuit.com 
2. Verify email address
3. Create a developer account

Anyone can create a developer account - no special permissions needed.

Permission Matrix by Role

HubSpot Super Admin

HubSpot Sales User (Deal Edit Access)

HubSpot Sales User (View-Only Deal Access)

QuickBooks Company Admin

QuickBooks Standard User

Common Permission Scenarios

Scenario 1: Installing for the First Time

Required:

• HubSpot Super Admin (you)
• QuickBooks Company Admin (you or colleague)
• Intuit Developer Account (you or colleague)

Process:

1. Intuit Developer creates QuickBooks app → Gets credentials
2. HubSpot Super Admin installs app → Approves OAuth scopes
3. HubSpot Super Admin enters credentials in settings
4. QuickBooks Company Admin authorizes during OAuth flow
5. Connection established

Minimum people needed: 1 person (if they have all three roles)

Scenario 2: Sales User Creating Invoices

Required:

• HubSpot user with Edit access to deals
• App already installed and connected (by admin)

Process:

1. Sales user opens deal record
2. Clicks QuickBooks Invoices tab (visible automatically)
3. Clicks “Create Invoice”
4. Fills invoice details and submits
5. Invoice created in QuickBooks

No admin permissions needed for daily invoice creation.

Scenario 3: Switching Environments (Sandbox to Production)

Required:

• HubSpot Super Admin (to change settings)
• QuickBooks Company Admin (to authorize production connection)
• Production credentials from Intuit Developer Portal

Process:

1. Super Admin disconnects Sandbox in HubSpot settings
2. Super Admin changes environment to “Production”
3. Super Admin enters Production credentials
4. QuickBooks Admin authorizes production connection

Sales users see no interruption - card remains visible, just shows “Not Connected” temporarily.

Scenario 4: Troubleshooting Connection Issues

Required:

• HubSpot Super Admin (to access settings and reconnect)
• QuickBooks Company Admin (if re-authorization needed)

Process:

1. Super Admin accesses settings
2. Verifies credentials are correct
3. Disconnects and reconnects if needed
4. QuickBooks Admin re-authorizes if requested

Sales users cannot troubleshoot - must contact admin.

Granting Permissions

How to Grant HubSpot Permissions

To make someone a Super Admin:

1. Go to Settings → Users & Teams
2. Find the user
3. Click Edit
4. Change role to Super Admin
5. Click Save

Warning: Super Admins have full account access. Only grant to trusted users.

To grant deal access:

1. Go to Settings → Users & Teams
2. Find the user
3. Click Edit
4. Under CRM → Deals, select access level:
   • View (can see deals and CRM card)
   • Edit (can create invoices)
   • Edit and delete (full access)
5. Click Save

How to Grant QuickBooks Permissions

To make someone a QuickBooks Admin:

1. Sign in to QuickBooks Online as Primary Admin
2. Go to Settings → Manage Users
3. Find the user or click Add User
4. Set user type to Company Admin
5. Click Save

Note: Only Primary Admin can create other admins.

To grant QuickBooks user access (if not an admin):

1. User needs to be invited to QuickBooks company
2. Role determines what they can do in QuickBooks
3. For the integration, admin authorization is one-time during OAuth

Permission Errors and Solutions

”You don’t have permission to install this app”

Cause: You’re not a Super Admin in HubSpot

Solution:

1. Contact your HubSpot administrator
2. Request Super Admin permissions
3. Or have an admin install the app

”You don’t have permission to access this page” (Settings)

Cause: You’re not a Super Admin

Solution:

1. Contact HubSpot admin
2. Only Super Admins can configure integration settings
3. For daily usage (creating invoices), you don’t need settings access

”You don’t have permission to create invoices”

Cause: You don’t have Edit access to deals

Solution:

1. Contact HubSpot admin
2. Request Edit or Edit and delete access for deals
3. View-only access is not sufficient

”Forbidden” or “Unauthorized” during QuickBooks OAuth

Cause: You’re not a QuickBooks Company Admin

Solution:

1. Sign out of QuickBooks
2. Sign in with Company Admin account
3. Complete OAuth authorization as admin
4. After connection, all HubSpot users (with deal access) can create invoices

CRM Card Not Visible

Possible causes:

• User doesn’t have access to deals
• User is viewing wrong object type (company/contact instead of deal)

Solution:

1. Verify user has at least View access to deals
2. Ensure you’re on a Deal record, not contact or company
3. Refresh the page

Best Practices

Admin Permissions

✅ Do:

• Grant Super Admin only to trusted users
• Limit number of Super Admins
• Use principle of least privilege
• Review permissions regularly

❌ Don’t:

• Give everyone Super Admin access
• Leave unused admin accounts active
• Share admin credentials

User Permissions

✅ Do:

• Grant deal edit access to sales users who need to create invoices
• Use teams to manage permissions at scale
• Document who has access to what

❌ Don’t:

• Grant edit access to users who only need to view
• Forget to revoke access when users change roles

QuickBooks Permissions

✅ Do:

• Use a dedicated QuickBooks admin account for integration
• Document which QuickBooks account authorized the integration
• Review authorized apps in QuickBooks periodically

❌ Don’t:

• Authorize with a personal QuickBooks account
• Authorize without understanding permissions granted

Frequently Asked Questions

Can regular users create invoices?

Yes, as long as they have Edit access to deals in HubSpot. They don’t need admin permissions for daily usage.

Do all users need to connect to QuickBooks individually?

No. One Super Admin connects the integration (using OAuth). After that, all users with deal access can create invoices.

Can I limit which users see the CRM card?

The card is visible to all users with deal access. You cannot selectively hide it from specific users. To hide it, remove deal access.

What if I don’t have Super Admin permissions?

Contact your HubSpot administrator. Only Super Admins can install and configure integrations.

Can a user with edit access change the QuickBooks connection?

No. Only Super Admins can access settings, change credentials, or disconnect QuickBooks.

What permissions does the integration have in QuickBooks?

The integration can create invoices, create customers, read tax codes, and read products. It cannot delete data, access bank accounts, or modify existing transactions (except invoices it created).

Can I use my personal QuickBooks account for the integration?

Technically yes, but not recommended. Use a company QuickBooks account with an admin who will maintain the integration long-term.

What if the QuickBooks admin leaves the company?

The integration continues to work (it uses OAuth tokens, not the admin’s personal credentials). To reconfigure, you need access to a current QuickBooks admin account.

Additional Resources

• HubSpot User Permissions Guide 
• QuickBooks User Roles 
• OAuth Scopes Reference - Detailed permission documentation
• Installation Guide - Step-by-step installation with permissions