HubSpot Private Apps for AEO: Lantern's auth model explained

What this does

HubSpot offers two integration auth models: Public Apps (marketplace-listed, OAuth2, multi-tenant) and Private Apps (per-portal, scoped access token, single-tenant). Lantern uses Private Apps because the scopes required for AEO pipeline attribution are sensitive enough (write access to Contact and Deal properties, workflow creation) that most security-conscious buyers prefer the per-portal audit trail a Private App provides.

How Lantern fits

On install, Lantern walks the admin through creating a Private App in HubSpot with a pre-defined scope set. The Private App name is 'Lantern AEO Attribution'. The token is stored encrypted in Lantern's vault and never sent to third parties. Revoking the Private App in HubSpot instantly kills Lantern's access (one-click, no support ticket).

Setup preview

Install flow: (1) Log into HubSpot as super admin. (2) Settings > Integrations > Private Apps > Create private app. (3) Name it 'Lantern AEO Attribution'. (4) Scopes tab: check the 9 scopes Lantern specifies (listed below). (5) Create app, copy the access token, paste into Lantern's onboarding wizard. (6) Lantern validates the token and scope set, reports any missing permissions, completes install.

# HubSpot Private App scopes for Lantern AEO
# Copy these into the Scopes tab during private app creation

# Read scopes (required)
crm.objects.contacts.read
crm.objects.deals.read
crm.objects.companies.read
crm.schemas.contacts.read
crm.schemas.deals.read

# Write scopes (required for attribution writeback)
crm.objects.contacts.write
crm.objects.deals.write
crm.schemas.contacts.write    # create custom properties
crm.schemas.deals.write       # create custom properties

# Automation scope (required for workflow creation)
automation

# Content scope (required for CMS Hub integration, optional)
content

# Tracking scope (required for tracking code injection, optional)
tracking

Where this fits in the bigger picture

This page describes one specific surface inside HubSpot where Lantern's AEO pipeline attribution plugs in. The full integration stitches together across HubSpot Contacts, Deals, Workflows, Lists, Reports, Forms, CMS, and the Marketing/Sales/Service Hub stack. If you're evaluating where to start, the comparison hub has side-by-side comparisons of Lantern against Profound, Scrunch, Peec AI, AthenaHQ, and HubSpot's own AEO product — scored on the dimensions that matter for a CMO buyer (CRM integration depth, reporting quality, prompt-scaling economics).

If you're about to walk this work into a renewal review or budget conversation, the CFO's Guide to AEO Budget Defense has the memo template, the five-slide deck structure, the attribution-math cheat sheet, and the three most-common CFO objections with counter-arguments. It's the long-form companion that translates the technical HubSpot setup on this page into a defensible dollar number for finance.