How to Connect HubSpot to OpenClaw: Automate Your CRM with AI

Sales reps spend roughly 28% of their week on CRM busywork: logging calls, updating deal stages, copy-pasting contact details between tabs. OpenClaw can handle most of that. By connecting HubSpot to OpenClaw through a custom skill, you get an AI agent that reads your pipeline, updates records, and alerts you to stale deals, all from a Telegram or WhatsApp message.

This guide walks through the full setup: creating a HubSpot Private App, writing the OpenClaw skill file from scratch, and testing it with real CRM queries. If you already have OpenClaw running, this takes about 20 minutes.

---

What This Integration Does

Once connected, your OpenClaw agent becomes a conversational interface to your HubSpot CRM. Instead of clicking through HubSpot’s UI, you message your agent and it handles the API calls behind the scenes.

Here is what you can do out of the box:

• Look up contacts and companies by name, email, or custom properties
• Check deal stages and pipeline status with a single message
• Create and update contacts, deals, and tasks without opening HubSpot
• Log calls, emails, and meeting notes directly from chat
• Get daily pipeline summaries via OpenClaw’s heartbeat or cron jobs

The agent uses HubSpot’s REST API (v3) through a Private App token. No third-party middleware, no paid connectors. Your data flows directly between your machine and HubSpot’s servers.

---

Before You Start

You need three things in place before connecting HubSpot to OpenClaw:

1. OpenClaw installed and running on your machine. If you have not done this yet, follow our OpenClaw setup guide first. The guide covers installation, workspace files, memory, and Telegram configuration.

2. A HubSpot account with permissions to create Private Apps. The free CRM tier works for contacts, companies, and deals. Marketing and Sales Hub Professional unlock workflow triggers and sequences.

3. A text editor to write and edit your skill file. VS Code, Cursor, or any editor that handles Markdown works fine.

---

Step 1: Create a HubSpot Private App

HubSpot Private Apps give you an access token scoped to specific permissions. This is the safest way to connect external tools because you control exactly what the token can read and write.

Generate the Token

1. Log into HubSpot and go to Settings (gear icon, top right)
2. Navigate to Integrations > Private Apps
3. Click Create a private app
4. Name it something clear: OpenClaw Integration
5. Under the Scopes tab, enable these permissions:

Scope	Permission	What It Enables
crm.objects.contacts.read	Read	Look up contacts
crm.objects.contacts.write	Write	Create/update contacts
crm.objects.companies.read	Read	Look up companies
crm.objects.deals.read	Read	Check deal pipeline
crm.objects.deals.write	Write	Update deal stages
crm.objects.owners.read	Read	Assign owners to records

We recommend starting with these six scopes. You can add more later (tasks, notes, marketing workflows) as you build out your automations.

6. Click Create app and copy the access token immediately. HubSpot only shows it once. If you lose it, you will need to rotate and generate a new one.

Store the Token Safely

Do not paste the token directly into your skill file. Store it in a .env file outside your OpenClaw workspace:

# ~/.env or ~/openclaw/.env
HUBSPOT_ACCESS_TOKEN=pat-na1-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

OpenClaw can read environment variables at runtime. This keeps the secret out of any file your agent might inadvertently share or log.

---

Step 2: Write the OpenClaw HubSpot Skill

OpenClaw skills are Markdown files that tell your agent what a tool does, when to use it, and how to call external APIs. The skill file lives in your workspace’s skills/ directory.

Create the Skill Directory

mkdir -p ~/.openclaw/workspace/skills/hubspot

Write the SKILL.md File

Create ~/.openclaw/workspace/skills/hubspot/SKILL.md with this content:

---
name: hubspot
description: Read and write HubSpot CRM data. Manage contacts, companies, deals, and tasks via the HubSpot REST API.
tools:
  - shell
---

# HubSpot CRM Skill

## Authentication

Use the environment variable `HUBSPOT_ACCESS_TOKEN` for all API requests.
All requests go to `https://api.hubapi.com` with the header:

Authorization: Bearer $HUBSPOT_ACCESS_TOKEN

## Available Operations

### Look Up a Contact

Search contacts by email or name:

curl -s -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -X POST "https://api.hubapi.com/crm/v3/objects/contacts/search" \
  -d '{
    "filterGroups": [{
      "filters": [{
        "propertyName": "email",
        "operator": "EQ",
        "value": "USER_EMAIL_HERE"
      }]
    }],
    "properties": ["firstname", "lastname", "email", "company", "phone"]
  }' | jq '.results[0].properties'

### List Deals in Pipeline

Fetch all open deals with their stages:

curl -s -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  "https://api.hubapi.com/crm/v3/objects/deals?properties=dealname,dealstage,amount,closedate&limit=50" \
  | jq '.results[] | {name: .properties.dealname, stage: .properties.dealstage, amount: .properties.amount, close: .properties.closedate}'

### Create a New Contact

curl -s -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -X POST "https://api.hubapi.com/crm/v3/objects/contacts" \
  -d '{
    "properties": {
      "email": "NEW_EMAIL",
      "firstname": "FIRST_NAME",
      "lastname": "LAST_NAME",
      "company": "COMPANY_NAME"
    }
  }' | jq '.id, .properties'

### Update a Deal Stage

curl -s -H "Authorization: Bearer $HUBSPOT_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -X PATCH "https://api.hubapi.com/crm/v3/objects/deals/DEAL_ID" \
  -d '{
    "properties": {
      "dealstage": "NEW_STAGE_ID"
    }
  }' | jq '.properties.dealstage'

## Rules

- Always confirm before creating or updating records. Ask the user to verify details first.
- When searching contacts, try email first. Fall back to name search if no email is provided.
- For deal updates, show the current stage and proposed change before executing.
- Respect rate limits: HubSpot allows 100 requests per 10 seconds for Private Apps.
- Never log the access token in responses or memory files.

What Each Section Does

The frontmatter (name, description, tools) tells OpenClaw when to activate this skill and what system tools it needs. The shell tool lets the agent run curl commands.

The operations section gives your agent templated API calls it can adapt. When you ask “Who is our contact at Acme Corp?”, the agent reads the search endpoint pattern, swaps in the company name, runs the curl command, and parses the JSON response.

The rules section sets guardrails. The confirmation rule is critical: you do not want your agent silently creating duplicate contacts or moving deals to the wrong stage.

---

Step 3: Test the Connection

Restart OpenClaw so it picks up the new skill:

openclaw gateway restart

Open your Telegram chat with your OpenClaw agent and try these queries:

Read test:

“How many contacts do we have in HubSpot?”

The agent should run a contacts list API call and return a count.

Search test:

“Find the contact record for jane@example.com”

The agent should return the contact’s name, company, phone, and other properties you scoped.

Write test (start small):

“Create a new contact: John Test, john.test@example.com, company: Test Corp”

The agent should ask you to confirm the details before creating the record. If it does not ask for confirmation, add a stronger instruction to the Rules section of your SKILL.md.

If any test fails, check these common issues:

Symptom	Likely Cause	Fix
401 Unauthorized	Token is wrong or expired	Regenerate in HubSpot > Private Apps
403 Forbidden	Missing scope	Add the required scope to your Private App
Empty results	Wrong search filter	Check property names match your HubSpot setup
Timeout	Network or rate limit	Wait 10 seconds, retry

---

What to Automate First

After the connection works, the temptation is to automate everything at once. Resist that. Start with read-only operations, build confidence, then expand.

Week 1: Lookups Only

Use your agent for quick CRM questions during your workday:

• “What stage is the Acme deal at?”
• “When was our last contact with Sarah at Globex?”
• “Show me all deals closing this month”

This builds your muscle memory for talking to the CRM through chat, and lets you verify the agent’s responses against HubSpot’s UI.

Week 2: Add Write Operations

Once lookups feel reliable, start creating and updating records:

• “Log a call with Jane at Acme, discussed pricing, she wants a proposal by Friday”
• “Move the Globex deal to Contract Sent”
• “Add a task: follow up with Dave at Initech next Tuesday”

Week 3: Add Automated Alerts

Use OpenClaw’s heartbeat or cron jobs to run periodic checks without being asked:

Add this to your heartbeat.md:

## Pipeline Health Check
Check HubSpot for deals that have been in the same stage for more than 14 days.
If any are found, send me a summary in the SFAI Agency Telegram group
with the deal name, current stage, days stuck, and deal owner.

Or set up a morning cron:

## Daily Pipeline Brief (runs at 8:00 AM)
Pull all deals closing in the next 7 days.
For each deal, check if there has been any activity in the last 3 days.
Send me a summary with deals that need attention.

This progression (read, then write, then automate) reduces the risk of your agent doing something unexpected with live CRM data.

---

Security Considerations

Your HubSpot token has direct access to your CRM. Treat it with the same care as a database password.

Least-access scoping. Only enable the API scopes you need right now. If you are not using marketing workflows, do not add marketing scopes. You can always expand permissions later.

Token storage. Keep the token in a .env file outside your workspace directory. Never put it in agents.md, soul.md, or any workspace file your agent reads into context.

Confirmation rules. The skill’s Rules section should require the agent to confirm before any write operation. This is your safety net against misunderstood instructions or prompt injection attempts.

Audit trail. HubSpot logs all API activity. Check Settings > Account > Audit Logs periodically to verify your agent is making the calls you expect.

For a deeper dive on OpenClaw security practices, see Step 9 in our OpenClaw setup guide.

---

Frequently Asked Questions

Do I need a paid HubSpot plan to connect OpenClaw?

No. HubSpot’s free CRM tier includes API access for contacts, companies, and deals. You can create Private Apps and use the REST API without paying. Paid plans (Sales Hub Professional, Marketing Hub Professional) unlock additional features like workflow triggers and sequences, but the core integration works on the free tier.

How long does this setup take?

About 20 minutes if OpenClaw is already installed. Creating the Private App takes 5 minutes. Writing and testing the skill file takes another 15. If you need to install OpenClaw first, add 30-45 minutes for the initial setup.

Can OpenClaw automatically update deals without me asking?

Yes, through heartbeat instructions or cron jobs. You write a rule like “every morning, check for deals with no activity in 7 days and send me a list,” and the agent runs it on schedule. Start with notifications only and add write permissions after you trust the agent’s judgment.

What happens if the HubSpot API rate limit is hit?

HubSpot’s Private App limit is 100 requests per 10 seconds. For normal conversational use, you will never hit this. If you set up aggressive automated scans (checking hundreds of deals every 30 minutes), you could. The API returns a 429 status code, and most implementations retry after a short wait. Add a note to your skill’s Rules section: “If you receive a 429 rate limit response, wait 10 seconds and retry once.”

Is it safe to give my AI agent CRM access?

As safe as you make it. Use least-access scoping (only enable scopes you need), store tokens in .env files (not in workspace files), and require confirmation for write operations. OpenClaw runs on your own machine, so data does not pass through third-party servers beyond HubSpot and your AI model provider. The biggest risk is prompt injection via emails or messages your agent reads. A strong model (GPT-5 or Claude Opus) handles this better than cheaper alternatives.

Can I use this from WhatsApp instead of Telegram?

Yes. OpenClaw supports WhatsApp, Slack, Discord, and iMessage in addition to Telegram. The HubSpot skill works the same regardless of which chat app you use. The only difference is the initial channel configuration. For 24/7 availability across all channels, you can run OpenClaw on a VPS like Hostinger.

---

Key Takeaways

• Connect HubSpot to OpenClaw by creating a Private App token and writing a custom SKILL.md file with API call templates
• Start with read-only lookups (contact search, deal status) before enabling write operations
• Store your HubSpot token in a .env file, not inside workspace files the agent can access
• Use heartbeat instructions or cron jobs for automated pipeline monitoring
• The free HubSpot CRM tier supports the full API integration with no paid connectors required