HubSpot

In your HubSpot account, click the Settings gear icon (top right), then navigate to Integrations → Private Apps in the left sidebar. Click Create a private app. Give it a name like 'FlutterFlow Integration' and add a description. Switch to the Scopes tab — this is where you define exactly which CRM objects the token can access. For lead capture plus deal visibility you need: crm.objects.contacts.read, crm.objects.contacts.write, crm.objects.deals.read. If you plan to create deals from the app, add crm.objects.deals.write. Avoid adding scopes you do not need — the token's blast radius if leaked is limited to what you scope. Click Create App in the top right, confirm the dialog, and you will see your Private App access token — a long string starting with 'pat-'. Copy it immediately; you cannot see it again after leaving this screen (you can regenerate it if you lose it, but all existing integrations using the old token will break). This token is your Bearer authentication credential — it goes directly into your backend environment variable only. Also make a note of your HubSpot portal ID (visible in the URL when logged in, e.g., app.hubspot.com/contacts/PORTAL_ID/).

Create a Firebase Cloud Function that accepts CRM operation requests from FlutterFlow, injects the Private App token from environment variables, and forwards them to https://api.hubapi.com. The function needs to handle at least three operations: create a contact (POST /crm/v3/objects/contacts), search contacts (POST /crm/v3/objects/contacts/search), and list deals (GET /crm/v3/objects/deals with optional filtering). Rather than building separate functions for each operation, use a routing approach: accept an 'operation' field in the request body that determines which HubSpot endpoint the proxy calls. Include CORS headers in every response so FlutterFlow web builds work without browser blocking. The rate limit is 100 requests per 10 seconds — for the FlutterFlow use case this is usually fine since the app does not batch many CRM calls simultaneously, but add a warning log when the proxy detects a 429 response from HubSpot. Deploy from your local machine using the Firebase CLI and copy the function's HTTPS trigger URL. Set the HubSpot token as an environment variable using Firebase Secret Manager or the config system — never hardcode it in the function source.

1// functions/index.js (Firebase Cloud Functions)
2const functions = require('firebase-functions');
3const fetch = require('node-fetch');
4
5const HUBSPOT_BASE = 'https://api.hubapi.com';
6
7exports.hubspotProxy = functions.https.onRequest(async (req, res) => {
8  res.set('Access-Control-Allow-Origin', '*');
9  res.set('Access-Control-Allow-Methods', 'POST, OPTIONS');
10  res.set('Access-Control-Allow-Headers', 'Content-Type');
11  if (req.method === 'OPTIONS') { res.status(204).send(''); return; }
12
13  const TOKEN = process.env.HUBSPOT_PRIVATE_APP_TOKEN;
14  const { operation, payload } = req.body;
15
16  const headers = {
17    'Authorization': `Bearer ${TOKEN}`,
18    'Content-Type': 'application/json'
19  };
20
21  let endpoint, method, body;
22
23  switch (operation) {
24    case 'create_contact':
25      endpoint = '/crm/v3/objects/contacts';
26      method = 'POST';
27      body = JSON.stringify({ properties: payload });
28      break;
29    case 'search_contacts':
30      endpoint = '/crm/v3/objects/contacts/search';
31      method = 'POST';
32      body = JSON.stringify(payload);
33      break;
34    case 'list_deals':
35      endpoint = '/crm/v3/objects/deals?properties=dealname,amount,closedate,dealstage';
36      method = 'GET';
37      break;
38    default:
39      res.status(400).json({ error: 'Unknown operation' });
40      return;
41  }
42
43  const hsRes = await fetch(`${HUBSPOT_BASE}${endpoint}`, { method, headers, body });
44  const data = await hsRes.json();
45  res.status(hsRes.status).json(data);
46});
47

In FlutterFlow, open API Calls in the left nav → + Add → Create API Group. Name it HubSpotProxy and paste your Cloud Function URL as the Base URL. No Authorization headers at the group level — the token is server-side. Create an API Call inside the group named createContact. Set method to POST, leave the endpoint path blank, and in the Body tab select JSON. Add two variables: operation (String, default value 'create_contact') and payload (JSON/String — the properties object for the new contact). Your body template: { "operation": "{{operation}}", "payload": {{payload}} }. For the payload value, build a JSON object in your Action Flow that includes email, firstname, lastname, and any custom properties like hs_lead_status or a custom 'app_source' field. In Response & Test, provide a sample payload like { "email": "test@example.com", "firstname": "Test", "lastname": "User" } and click Test. A successful create returns HTTP 201 with the new contact object including its id. Now go to your sign-up success screen in FlutterFlow. In the Action Flow Editor for the completion action, add a Backend/API Call action selecting createContact. Build the payload using FlutterFlow's Set Variable actions to combine the user's form inputs into the properties JSON. Add a conditional check on the API response status (201 = success) and show a success snackbar. Handle non-201 responses with an error message so users know if the CRM write failed without crashing the app.

1{
2  "operation": "{{operation}}",
3  "payload": {{payload}}
4}

Create a second API Call in the HubSpotProxy group named searchContacts. Set method to POST. The body variables: operation (String, default 'search_contacts') and payload (String — the HubSpot search filter body). The HubSpot search endpoint uses a POST with a JSON body containing filterGroups, sorts, properties, and limit. A common search payload for finding a contact by email: { "filterGroups": [{ "filters": [{ "propertyName": "email", "operator": "EQ", "value": "{{email}}" }] }], "properties": ["email", "firstname", "lastname", "phone"], "limit": 10 }. This is a POST request with a filter body — not a GET with query parameters. In FlutterFlow, set the payload variable to this JSON string with the email from a search text field. Create a third API Call named listDeals with operation 'list_deals'. Create a Data Type called HubSpotDeal with fields: dealId (String), dealName (String), amount (String), closeDate (String), dealStage (String). Map the JSON Paths from the deals response: $.results[*].id, $.results[*].properties.dealname, $.results[*].properties.amount, $.results[*].properties.closedate, $.results[*].properties.dealstage. Build a Deals screen in FlutterFlow with a ListView bound to the listDeals Backend Query. Inside each ListView item, show the deal name, amount formatted as currency, and a colored badge for the deal stage. To keep the deal stage badge colors accurate, maintain a small JSON lookup in App State mapping HubSpot stage IDs to human-readable labels and display colors.

1{
2  "filterGroups": [{
3    "filters": [{
4      "propertyName": "email",
5      "operator": "EQ",
6      "value": "{{email}}"
7    }]
8  }],
9  "properties": ["email", "firstname", "lastname", "phone", "company"],
10  "limit": 10
11}

HubSpot's rate limit is 100 requests per 10 seconds on most plans. For a single user opening a deals screen this is fine — but if multiple sales reps use the app simultaneously and each screen load triggers multiple CRM reads (deals list, contact details, pipeline stages), you can easily approach the limit. The safest approach is to cache deal list responses in Firestore or Supabase with a 5-minute TTL. Deal data changes infrequently enough that 5-minute freshness is acceptable for a mobile sales tool. For contact searches (which users expect to be real-time), do not cache — always hit the live API. Add the caching logic inside your Cloud Function for the list_deals operation only: check a Firestore document for a recent deals snapshot and return it if it is under 5 minutes old. For bulk syncs — importing all HubSpot contacts into your app's own database — use a scheduled Cloud Function with sequential loops and a small delay between batches rather than on-device batching, which would burn through the rate limit instantly. If you need help building the bulk sync or a more sophisticated caching strategy for multi-rep deployments, RapidDev's team builds FlutterFlow integrations like this every week — free scoping call at rapidevelopers.com/contact.

1// Caching for list_deals operation inside hubspotProxy
2const admin = require('firebase-admin');
3if (!admin.apps.length) admin.initializeApp();
4const db = admin.firestore();
5
6// Inside the 'list_deals' case:
7const cacheRef = db.collection('hubspot_cache').doc('deals_list');
8const cached = await cacheRef.get();
9if (cached.exists) {
10  const { payload, cached_at } = cached.data();
11  if (Date.now() - cached_at < 5 * 60 * 1000) { // 5 minutes
12    res.json({ ...payload, from_cache: true });
13    return;
14  }
15}
16// Fetch from HubSpot, then cache:
17const data = await hsRes.json();
18await cacheRef.set({ payload: data, cached_at: Date.now() });
19res.json({ ...data, from_cache: false });
20