Website form to HubSpot contacts: every email address becomes a contact
Anticode's HubSpot connector turns anyone who sends a form with an email address into a HubSpot contact, filling email, first name, last name and phone where the form has them. It needs one credential, a private app access token. Someone who's already in your CRM is left as they are rather than duplicated.
What it's for
If your sales or follow-up already runs in HubSpot, the worst outcome of a website enquiry is that it lives only in an inbox and never becomes a record. Sending each website form to HubSpot contacts means the person exists in the CRM before anyone replies, so lists, sequences, deal pipelines and reporting can pick them up. The connector does that one job and keeps it narrow.
How fields map
| Form field | HubSpot property | Notes |
|---|---|---|
| Required. Lower-cased; forms without a valid address are skipped | ||
| name (first word) | firstname | "Ana María López" gives Ana |
| name (the rest) | lastname | "María López"; left out if the name is one word |
| phone | phone | Booking forms only |
Every built-in form has an email field, so bookings, contact messages, newsletter sign-ups and invite requests can all create contacts. A sign-up has no name, so it creates a contact with just the email.
Create the private app
HubSpot now lists private apps under legacy apps. Its private apps overview says they're still supported, that only super admins can open them, and describes this path:
- In HubSpot, go to Development › Legacy apps, choose Create legacy app and select Private.
- Name it something you'll recognise later, such as "Website forms".
- On the Scopes tab, add
crm.objects.contacts.writeandcrm.objects.contacts.read. Nothing else is needed. - Create the app and copy the access token. It starts with
pat-and a region code, such aspat-na1-orpat-eu1-. - In Anticode, open Connectors › HubSpot, paste it into Private app token and press Save and turn on.
- Press Check the connection.
The check reads a single contact to prove the token and scopes work. It doesn't create a test contact, so your CRM stays clean.
Existing contacts
HubSpot treats email as a contact's unique key and answers with a conflict when you create someone who already exists. Anticode treats that answer as success. The upside: a returning customer doesn't become a duplicate. The trade-off: their record isn't updated either, so a new phone number on a second booking won't overwrite the old one. If you want updates, send submissions through the webhook connector to an automation that searches and updates.
Consent and lawful basis
Creating a contact doesn't subscribe anyone to marketing email, and the connector doesn't set subscription types. Someone who asked about a booking hasn't agreed to your newsletter, so keep marketing permission separate: use HubSpot's subscription settings, or send newsletter sign-ups to Mailchimp or Kit, which only ever receive sign-ups. Mention HubSpot in your privacy policy as a place enquiries are stored.
One portal for every site
The token is saved once per Anticode account and applies to every site you publish, so contacts from all of them land in the same HubSpot account. HubSpot isn’t told which site or which form a contact came from. If that matters for reporting, create a HubSpot list or workflow based on when contacts were created, or run submissions through a webhook and an automation that sets a property such as lead source before creating the contact.
Security
- The token is sealed with AES-256-GCM, bound to your account and this connector, and never displayed again.
- It's used only on Anticode's server to call HubSpot's own API address; it never appears in the builder or your pages.
- Scope it to contacts only. If it leaks, rotate it from the app's Auth tab and paste the new one.
When a contact doesn't appear
- The form had no valid email. Nothing is sent, by design.
- They already existed. Search HubSpot by email; the old record is still there, unchanged.
- HubSpot answered 401 or 403. The token was rotated, or a scope is missing. Fix the app and save the new token.
- HubSpot was unreachable. Each submission is sent once, about a minute after it arrives, with no retries. Add the person from your Anticode Submissions.
Questions people ask
Does this use HubSpot's own forms?
No. Your site keeps its own forms; Anticode calls HubSpot's contacts API on the server.
Can it create deals or tickets?
No, only contacts. Use HubSpot workflows on new contacts, or a webhook to an automation tool.
Will my test add a fake contact?
No. Check the connection only reads, it never writes.