HubSpot CMS Memberships vs a Custom Portal: When the Native Feature Stops Being Enough

If you run a HubSpot site and you want to put content behind a login, the first thing you will reach for is memberships. It is built in, it uses your CRM as the identity store, and for a lot of use cases it is exactly the right tool. The trouble starts when a buyer assumes memberships can do everything a portal can do. They cannot, and the gap between gating a page and running a real self-service portal is wider than the marketing pages suggest.

This article sets out what HubSpot CMS memberships natively provide, where they stop, and how to tell when you should step up to a bespoke customer or partner portal. It is written for the person making the build-or-buy call, not for a developer following a tutorial.

What HubSpot memberships actually are

Memberships are part of HubSpot's CMS product, now called Content Hub (rebranded from CMS Hub in 2024). Some older HubSpot help articles still say CMS Hub, and legacy CMS Hub or Marketing Hub Enterprise subscriptions are still referenced for backwards compatibility, so do not be thrown by the naming.

At their core, memberships require a visitor to have an account (register, set a password, log in) before they can view gated content. HubSpot calls these gated areas private content, and it uses your HubSpot CRM contact records as the single source of truth for who is allowed in. There is no separate user database to maintain.

You can gate the following content types:

• Website pages
• Landing pages
• Blog posts
• Knowledge base articles
• The native Service Hub customer portal

Access is controlled through what HubSpot calls access groups. Static groups contain contacts you add manually or via a static segment. Dynamic groups add contacts automatically based on CRM filter criteria, so your lists and audiences drive who can see what. Once a contact registers, that single registration grants access to everything they are eligible for. They do not have to register again every time you publish a new gated page.

On the password side, HubSpot enforces a minimum of 12 characters with uppercase, lowercase, and a number or symbol. There is a native social login module (Google and Facebook sign-in) you can switch on in a coded membership template, although be aware the documentation for it is dated and references the Google Plus era, so treat it as a basic, legacy option rather than a polished modern flow.

Single sign-on and the moving floor

If you need single sign-on, memberships support SAML 2.0 and OpenID Connect (OIDC), with OIDC being the recommended path. This matters for buyers who have seen blog posts claiming SSO is "Enterprise only". HubSpot's official knowledge base states that SSO for private content is available on Content Hub Professional or Enterprise, and Service Hub Professional or Enterprise, for their respective content types. If a third party told you it was Enterprise only, that claim is imprecise.

One verified detail is worth holding onto. From 5 February 2025, HubSpot stopped allowing new JWT-based SSO applications for private content. Existing JWT apps set up before that date keep working, but any new setup must use OIDC or SAML. The point for a buyer is simple: even native authentication has a moving floor. The thing you build on today can shift, and that is part of the calculation when you weigh native features against a portal you control.

The tier requirements, in plain terms

What you can gate depends on your subscription:

• Pages and blog posts as private content need Content Hub Professional or Enterprise (legacy Marketing Hub Enterprise also supports them).
• Knowledge base articles and the native customer portal as private content need Service Hub Professional or Enterprise.
• Professional accounts are limited to 2 access groups. Enterprise accounts can have up to 100.

That access group cap is a quiet but real ceiling. If your membership model needs more than two distinct audiences and you are on Professional, you have a decision to make before you have built anything.

Where memberships hit their limits

This is the part that catches buyers out. Memberships are excellent at one job: deciding whether a given logged-in contact is allowed to see a given page. They were not designed to be an application platform. Here is where the wall is.

Per-member data display is constrained

You can read a logged-in contact's list memberships in HubL, but for security reasons only product and marketing-event objects can be retrieved on a publicly accessible page. Anything else has to sit behind membership. Building a genuine data-driven dashboard, one that shows a logged-in user their deals, tickets, invoices, or custom-object records, means writing serverless and coded logic. It is not a native toggle.

There is no UI scaffolding

Memberships gate content. They do not give you a member dashboard, account navigation, profile management, or self-service screens. You build the login pages, the dashboards, and the navigation yourself. The feature is a gate, not a building.

Custom-object personalisation is limited

HubSpot's personalisation tokens pull from standard objects. Custom-object properties are not natively available for personalised content outside coded dynamic-page templates. If your value proposition is showing each customer their own custom-object data in a friendly layout, you are in build territory.

The identity model is HubSpot-centric

One contact equals one login. Memberships have no native concept of organisation-level roles or per-company permission tiers. If you need a customer's admin to see everything while their colleagues see a subset, or parent and child account access, memberships do not model that for you.

There is no logic depth

Gating is list and filter based. Conditional journeys, entitlement logic, usage metering, and transactional actions (placing an order, raising and tracking a ticket with custom states, pulling live data from an external system) are not membership features. They require a custom build using serverless functions, UI extensions, and external integrations.

The dividing line

Here is the test we use with clients. Memberships are the right tool when you need to gate existing content (a resource library, a gated blog, a knowledge base, course pages), your audiences map cleanly to lists, and "log in and check this contact is allowed to see this page" is the whole requirement. That is a large and legitimate set of use cases, and our HubSpot CMS memberships service exists precisely to get that built properly.

You should step up to a bespoke customer or partner portal when you need any of the following:

• Per-user or per-company data views pulling from CRM custom objects or external systems
• Role and permission tiers within a customer organisation
• Transactional self-service such as orders, tickets, account management, or document exchange
• A designed dashboard experience that goes well beyond gated pages
• Data residency, ownership, or hosting control
• Authentication requirements beyond what native SAML or OIDC SSO covers

If you recognise two or three of those, memberships will get you started and then become a constraint you spend money working around. That is the expensive path: building brittle middleware and one-off workarounds on top of a feature that was never meant to carry them.

How SpotDev approaches the choice

We are a software engineering firm for HubSpot customers, a UK HubSpot Diamond Partner with an in-house engineering team. We are not in the business of selling you the biggest build. Our default is to use the native feature where it genuinely does the job, and to recommend a portal only when the requirements above are real. When a portal is the right answer, we build productised solutions you can own, hosted so you keep control of your data and your hosting.

If you want to understand the full picture before you commit, our guide to customer portals for mid-market B2B covers the category in depth, and our customer portals service page sets out how we deliver them. For the wider engineering capability behind both routes, see our HubSpot development hub.

If you already know your requirements have outgrown a native gate, the quickest way forward is to tell us what you are trying to give your customers access to. Request a quote and we will tell you honestly whether memberships will carry it or whether you need a portal, and what each route costs.

Frequently asked questions

Do HubSpot memberships require an Enterprise subscription?

No. HubSpot's official knowledge base states that private content, access groups, and SSO are available on Content Hub Professional or Enterprise, and on Service Hub Professional or Enterprise for their respective content types. Some third-party articles claim it is Enterprise only, but that is imprecise. The main Professional limitation is the cap of 2 access groups, against up to 100 on Enterprise.

Can HubSpot memberships show each logged-in user their own data?

Only in a limited way. You can read a contact's list memberships in HubL, but for security only product and marketing-event objects can be retrieved on a publicly accessible page. A true per-user dashboard showing deals, tickets, invoices, or custom objects requires custom serverless and coded logic, which is a build rather than a native toggle. At that point a bespoke portal is usually the cleaner option.

What content can HubSpot memberships gate?

Website pages, landing pages, blog posts, knowledge base articles, and the native Service Hub customer portal. Access is controlled through access groups, which can be static (contacts you add manually) or dynamic (contacts auto-added by CRM filter criteria such as lists and audiences).

When should I choose a custom portal over HubSpot memberships?

Step up to a custom portal when you need per-user or per-company data views from CRM custom objects or external systems, role and permission tiers within a customer organisation, transactional self-service such as orders or ticket tracking, a designed dashboard experience beyond gated pages, data residency or hosting control, or authentication beyond native SAML and OIDC SSO. Memberships are the right tool when gating existing content is the whole requirement.

Does HubSpot membership SSO still support JWT?

From 5 February 2025, HubSpot stopped allowing new JWT-based SSO applications for private content. Existing JWT apps configured before that date continue to work, but any new setup must use OpenID Connect (recommended) or SAML 2.0.