If you’re wondering how to get an API key for HubSpot, here’s the deal: the old-style API keys you might be used to are actually no longer supported! HubSpot officially phased them out on November 30, 2022. This means if you had any existing integrations relying on those keys, they probably stopped working around that time unless they were updated. And forget about creating a new one. new API keys couldn’t be generated after July 15, 2022.

So, what’s the solution? HubSpot has moved to a much more secure and flexible system: Private Apps and their associated access tokens, or OAuth 2.0 for public applications. Think of a private app’s access token as your modern, upgraded API key. This change is all about boosting security and giving you way more control over what your integrations can actually do in your HubSpot account.

This guide is going to walk you through everything you need to know about working with HubSpot’s API . We’ll explore why this shift happened, how to create and manage these new “API keys” aka private app access tokens, how to use them safely, and some cool things you can do with HubSpot’s powerful API. So, let’s get into it and make sure your HubSpot integrations are running smoothly and securely!

Before we jump into the new stuff, let’s briefly touch on what HubSpot API keys used to be. Back in the day, a HubSpot API key was essentially a unique, long string of alphanumeric characters. You’d generate it in your HubSpot portal, and then you could use it to authenticate your custom applications or integrations with HubSpot’s APIs. It was a pretty straightforward way to let different software systems talk to each other and share data with your HubSpot account.

Developers would use this key to create all sorts of custom functionality, like custom objects, integrations, and webhook calls, or to update data through API calls. It was often the quickest and easiest way to get an integration up and running.

Table of Contents

The Problem with the Old API Keys: A Security Check

Now, while convenient, the old API keys had a pretty big flaw: they were a bit like giving someone the master key to your entire house. An API key typically provided unfettered read and write access to all of your HubSpot CRM data. This meant if that single API key ever got compromised – maybe it was accidentally exposed in code, a public repository, or an insecure communication channel – a malicious actor could potentially have unlimited access to your sensitive customer data. That’s a massive security risk!

Think about it: in your HubSpot portal, you usually set specific permissions for different users, right? Some people can only view contacts, others can edit deals, and so on. But with the old API key, those granular controls just weren’t there. It identified the project or application making the call, not the individual user or what specific data they needed. This lack of fine-grained control and the “all-or-nothing” access was a major security concern.

Best practices for API security often include rotating keys regularly every one to six months, but many users never did this, further increasing the risk. HubSpot, like any responsible platform, recognized this inherent risk and decided it was time for an upgrade.

The Big Shift: Farewell, API Keys! Hello, Private Apps!

So, to tackle these security challenges and provide users with better control, HubSpot announced the deprecation of API keys, with the full sunset happening on November 30, 2022. This was a significant move, and if you had custom integrations, it likely meant you had to update how they authenticated with HubSpot.

The new, recommended way to authenticate internal custom integrations with HubSpot’s API is through Private Apps. If your integration is meant to be used by multiple HubSpot accounts like a public app listed in the App Marketplace, then you’d use OAuth 2.0. For most custom, internal integrations, private apps are your go-to. HubSpot Academy Courses: Your Free Ticket to Marketing & Sales Mastery!

What Are Private Apps, Anyway?

Private apps are basically custom-made applications that you build specifically for your HubSpot account. They’re not available in the HubSpot App Marketplace. they’re unique to your organization. The key difference is that instead of a single, all-powerful API key, private apps generate a unique access token that acts as your “API key.”

The real magic here is that these private app access tokens are scoped. This means when you create a private app, you get to choose exactly what permissions it has. Does it only need to read contact data? Great, you can grant it only crm.objects.contacts.read permission. Does it need to create deals? You’d add crm.objects.deals.write. This granular control ensures that even if an access token were compromised, the damage would be limited to only the specific data and actions you’ve allowed.

This is a huge step up in security! It’s like giving someone a key that only opens the shed, not the whole house. Private apps provide much tighter security and allow more granular control over your integrations and account data than those legacy API keys ever did.

How to Get Your HubSpot “API Key” The Private App Way!

Alright, let’s get to the practical stuff. If you need to get an API key for HubSpot now, you’ll be creating a private app and generating its access token. You need to be a super admin in your HubSpot account to do this. Is a VPN Safe for Aynax? Let’s Break Down Business Security

Here’s a step-by-step guide to create a private app and retrieve its access token:

Step 1: Navigate to the Private Apps Section

Log in to your HubSpot account. You’ll want to be in the account where you need the integration to function.
Click the settings icon ⚙️ in the main navigation bar, usually located in the top-right corner.
In the left sidebar menu, find and click on Integrations, then select Private Apps.

Step 2: Create a New Private App

On the Private Apps page, click the “Create a private app” button.
You’ll be taken to the “Basic Info” tab. Here, you need to configure some details for your app:
- App Name: Give your app a clear, descriptive name. This helps you identify what the app does later on e.g., “Website Contact Sync,” “CRM Reporting Tool”.
- App Logo Optional: You can upload a logo if you want to make it easier to distinguish your apps.
- Description Optional: Add a brief description of what this app is for. This is super helpful for remembering its purpose down the line.

Step 3: Configure Your App’s Scopes Permissions

This is the most crucial step for security and functionality. The “Scopes” tab is where you define exactly what data and actions your private app’s access token will be allowed to interact with. Remember, only grant the minimum necessary permissions! Is VPN Safe for Axos Bank? Your Ultimate Guide to Secure Online Banking

Go to the “Scopes” tab.
At the top of the page, click “Add new scope” or simply select the checkboxes for the permissions you need.
You’ll see a list of categories like CMS, CRM, Settings, and Standard. Expand these sections to see the specific read and write permissions available for different HubSpot objects like contacts, companies, deals, marketing emails, etc..
* For example, if your app just needs to read contact information, you’d select crm.objects.contacts.read. If it needs to update contacts, you’d also select crm.objects.contacts.write.
* You can use the search bar to find specific scopes.
Carefully select only the scopes that your integration genuinely requires. Granting too many permissions defeats the purpose of private apps’ enhanced security.
* Pro Tip: HubSpot’s CRM objects are often linked. If you’re working with deals, you might also need access to associated contacts or companies. Plan your data model beforehand to ensure you select all necessary scopes.

Step 4: Review and Create Your App

Once you’ve configured your app’s basic info and scopes, click the “Create app” button usually in the top right corner.
HubSpot will then present you with a warning, reminding you that this app will generate an access token that can view or update your HubSpot account data. It’s a security-sensitive item, so only share it with trusted individuals. Click “Continue creating” or confirm to proceed.

Step 5: Retrieve Your Access Token Your New “API Key”

Congratulations! Your private app is now created. The final step is to get the access token.

After creating the app, you’ll land on its details page. Go to the “Auth” tab.
You’ll see a long string labeled “Access token”. Click “Show token” to reveal it, and then click “Copy” to copy it to your clipboard.
- IMPORTANT: Treat this access token with the same or even greater care you would a password. It’s unique to this private app and gives access based on the scopes you defined. If it gets compromised, someone could potentially access or manipulate your HubSpot data.

This copied access token is what you’ll use in your custom code or third-party integrations to authenticate with the HubSpot API. It’s essentially your new, more secure api key hubspot.

Is Using a VPN Safe at the Airport? Your Ultimate Guide to Secure Travel

Making API Calls with Your Private App Access Token

Now that you have your private app and its access token, how do you actually use it? When you make API calls to HubSpot, you’ll include this access token in the Authorization header of your HTTP request.

It generally looks like this:

Authorization: Bearer YOUR_ACCESS_TOKEN

Where YOUR_ACCESS_TOKEN is the token you just copied.

Here’s a simplified example of how you might use it in a curl command a common way to test API calls: Is vpn safe for asian countries

curl --request GET \
  --header "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --url "https://api.hubapi.com/crm/v3/objects/contacts?limit=10"

This request would fetch the first 10 contact records from your HubSpot account, provided your private app has the crm.objects.contacts.read scope.

Many programming languages and libraries have built-in ways to handle authorization headers, making it straightforward to integrate into your applications. You can even use tools like Postman to test your API calls by setting the HTTP method GET, POST, PUT, DELETE, the endpoint, and the Authorization header with your Bearer token.

Why Private Apps Are a Game Changer for Your Integrations

The shift from simple API keys to private apps and their access tokens is more than just a technical change. it’s a huge step forward for security and control. Here’s why:

Granular Permissions Scopes: This is the biggest advantage. You no longer have to give “root access” to your entire HubSpot portal. You can specify exactly what an integration can see and do, minimizing the risk if an access token is ever exposed. If an app only needs to read contacts, it won’t be able to delete deals, for example.
Enhanced Security: With limited scopes, a compromised token can only affect a small portion of your data, making your HubSpot account much more secure overall. This is a crucial defense against potential data breaches.
Better Management: Each private app has its own token. This means you can create multiple apps for different purposes, each with its own set of permissions. If you need to revoke access for one integration, you can simply rotate or deactivate that specific app’s token without affecting any other integrations. This is a huge improvement over the old API key, where rotating it would break all integrations using it.
Clearer Accountability: When you review your integrations, it’s easier to see which specific app is accessing what data, which helps with auditing and troubleshooting.
Future-Proofing: HubSpot is continuously improving its API ecosystem. Adopting private apps aligns you with the platform’s current and future security standards.

Common Use Cases for HubSpot APIs with Private Apps

Now that you know how to connect, let’s talk about what you can do. HubSpot’s API is incredibly powerful for customizing and extending the platform. Around 70% of businesses are expected to adopt automation tools in the next few years, and APIs are central to this trend. Here are some popular use cases:

Data Synchronization: This is probably the most common. Many businesses use HubSpot alongside other systems like an accounting software, an e-commerce platform, or a different CRM. The API allows you to automatically sync data contacts, companies, deals, invoices, products, etc. between HubSpot and these other tools. For instance, when a new customer makes a purchase on your e-commerce site, you can use the API to automatically create or update a contact record in HubSpot. This ensures consistent and up-to-date information across all your platforms, reducing manual data entry and errors.
Automating Tasks and Workflows: The API lets you automate repetitive tasks within HubSpot or trigger actions based on external events.
- Lead Generation & Nurturing: Capture user data from your website or application and automatically sync it with your HubSpot CRM. When a user downloads a resource, they can automatically be added to a specific email campaign.
- Sales Automation: Automatically create new contact records when a user signs up on your website, or update deal stages based on actions taken in another system.
- Customer Service: Sync tickets or conversations from other platforms into HubSpot, or create custom workflows for service requests.
Building Custom Integrations: If there isn’t a native integration in the HubSpot App Marketplace for a specific tool you use, you can build your own custom integration using the API. This is perfect for niche industry software or internal tools. For example, you might integrate HubSpot with a custom HR system or a specialized project management tool.
Custom Reporting and Analytics: Pull data from various HubSpot objects into external reporting tools or custom dashboards to get more tailored insights. This allows you to monitor performance metrics in real-time, combining HubSpot data with other business data for a comprehensive view.
Extending HubSpot Functionality: Add custom features that aren’t available out-of-the-box. This could involve creating custom objects, properties, or specialized forms that interact with your data in unique ways.
Webinars and Events: If you host webinars or events on a third-party platform, the API can feed registrant and attendee data directly into HubSpot, keeping your CRM records complete.

The possibilities are vast, but remember, always define your use case clearly before you start building to ensure you select the right scopes for your private app. What Makes a VPN Truly Safe? The Core Pillars of Protection

Tips for Managing Your Private Apps and Access Tokens

Since your private app access token is basically your new API key, treating it with care is paramount. Here are some best practices:

Secure Storage: Never hardcode your access token directly into your application’s source code. Instead, use secure methods like environment variables, secrets management services e.g., AWS Secrets Manager, HashiCorp Vault, or a password manager. This prevents accidental exposure if your code is shared or goes into a version control system.
Least Privilege Principle: We’ve already talked about scopes, but it bears repeating: only grant the absolute minimum permissions scopes that your integration needs. This limits the damage if a token is ever compromised.
Regular Rotation: Even with all the security measures, it’s a good idea to rotate your access tokens periodically, ideally every six months, or whenever an employee who had access leaves the company.
- To rotate a token: In your HubSpot account, go to Settings > Integrations > Private Apps, click the name of your app, go to the Auth tab, and click “Rotate” next to your access token. If you suspect a compromise, choose “Rotate and expire now” for immediate revocation.
Monitor Logs: Keep an eye on the API call logs for your private apps found under the “Logs” tab of your private app settings. This helps you track activity, identify unusual patterns, and troubleshoot issues.
Use HTTPS/SSL: Always ensure your API requests are made over HTTPS/SSL. Most reputable APIs, including HubSpot’s, will require this for security.
Error Handling and Retry Logic: Implement robust error handling in your code. HubSpot, like any API, has rate limits how many requests you can make in a given time. If you hit a rate limit, use retry logic with exponential backoff to avoid getting blocked and to ensure your application is resilient.
Versioning: Pay attention to API versioning. HubSpot regularly updates its APIs, and using consistent versioning in your calls helps avoid disruptions when new features are released.

By following these practices, you can make the most of HubSpot’s powerful API capabilities while keeping your data safe and secure.

Troubleshooting Common Issues

Even with the best planning, you might run into a snag or two. Here are some common issues and what to check:

“My integration stopped working after November 30, 2022!”
- This is almost certainly due to the API key deprecation. You need to migrate your integration to use a private app access token or OAuth 2.0.
“I’m getting an ‘Unauthorized’ or ‘401’ error.”
- Double-check that your access token is correct and hasn’t expired or been rotated.
- Ensure you’re including the Authorization: Bearer YOUR_ACCESS_TOKEN header correctly in your API request.
- Verify that your private app has the necessary scopes permissions for the API endpoint you’re trying to access. If it’s a GET request, you need read access. for POST, PUT, or DELETE, you’ll need write access.
“I can’t create a new API key in my HubSpot portal.”
- That’s because you can’t anymore! New API keys were discontinued in July 2022. You need to create a private app instead.
“My API calls are failing due to rate limits.”
- HubSpot has limits on how many API requests you can make in a certain timeframe. If you exceed these, your requests will be throttled.
- Implement retry logic with exponential backoff in your code.
- Consider batching requests where possible, especially for non-time-sensitive data updates.
- Review your API call patterns to identify and optimize inefficient requests.
“My private app isn’t showing up or I can’t access it.”
- Make sure you are logged in as a super admin in the HubSpot account where the private app was created. Only super admins can manage private apps.
- Confirm you’re in the correct HubSpot portal if you manage multiple accounts.
“My integration needs to handle custom timeline events or webhooks.”
- Webhooks are supported in private apps, but subscriptions for webhooks cannot be edited programmatically via an API. they must be edited in your private app settings.
- For custom timeline events, you might need to use a public app with OAuth 2.0, as private apps do not support them.

When in doubt, consult HubSpot’s developer documentation. It’s a goldmine of information and example code for specific API endpoints.

Frequently Asked Questions

What is a HubSpot API Key, and is it still used?

A HubSpot API Key was a unique identifier used to authenticate applications or users with HubSpot’s APIs. However, HubSpot deprecated the old API keys on November 30, 2022. They are no longer supported for authentication. Instead, you’ll use Private Apps and their associated access tokens for custom internal integrations, or OAuth 2.0 for public apps. Understanding “AquaSafe”: More Than Just One Thing

How do I “get” or “create” an API key for HubSpot now that the old ones are deprecated?

You no longer “get” an old-style API key. Instead, you need to create a Private App in your HubSpot account. This private app will generate an access token, which serves as your modern “API key.” You can create one by going to Settings > Integrations > Private Apps in your HubSpot portal, giving it a name, and carefully selecting the necessary permissions scopes.

What’s the difference between an old HubSpot API Key and a Private App access token?

The key difference is security and control. The old API key provided broad, often unfettered, read and write access to your HubSpot data. A Private App access token, on the other hand, allows for granular permissions scopes. You specify exactly what data and actions the app can access, significantly limiting potential damage if the token is compromised.

Where is the HubSpot API key location or the Private App access token?

To find your Private App access token:

Log into your HubSpot account.
Click the settings icon ⚙️ in the main navigation bar.
In the left sidebar, navigate to Integrations > Private Apps.
Click on the name of your specific private app.
Go to the “Auth” tab, and you’ll see your access token. Click “Show token” and then “Copy.” Remember to keep this token secure!

What happens if I don’t migrate my old API key integrations to Private Apps?

If your custom integrations were still using the old API keys after November 30, 2022, they would have stopped working. HubSpot no longer recognizes API keys as a valid authentication method, so any API calls using them will fail.

Can I still use HubSpot APIs for integrations with third-party tools?

Absolutely! HubSpot’s APIs are still incredibly powerful for integrating with other systems. You just need to ensure these integrations use the current authentication methods: Private Apps with access tokens for internal, custom integrations, or OAuth 2.0 for public apps intended for multiple HubSpot accounts. Is VPN Safe for AOL Mail? Your Ultimate Guide to Secure Email

How often should I rotate my Private App access token?

It’s a good security practice to rotate your Private App access tokens regularly, ideally every six months. You should also rotate them immediately if you suspect the token has been compromised, or if an employee who had access to it leaves your organization.

0.0

0.0 out of 5 stars (based on 0 reviews)

Excellent0%

Very good0%

Average0%

Poor0%

Terrible0%

There are no reviews yet. Be the first one to write one.

Amazon.com: Check Amazon for Understanding HubSpot API
Latest Discussions & Reviews:

BestFREE.nl

Understanding HubSpot API Keys (The Old Way)