If you have Super Admin access in your account, you can access your HubSpot API key in your integrations settings. With the HubSpot API key, your developers can create APIs that interact with information in your HubSpot account.
Because of the access your HubSpot API key grants, consider rotating your HubSpot API key every six months for security reasons. Rotating your HubSpot API key will deactivate the existing API key and generate a new one. HubSpot will display the age of the API key and recommend when you should rotate your API key.
Reminders to rotate the API key will be sent to Super Admins and users who last created or rotated the API key in the following frequencies and notification types:
- When the API key turns five months old, email notifications are sent.
- The the API key turns six months old, sidebar notifications are sent.
- When the API key has not been rotated in six months, both email and sidebar notifications will be sent every six months.
While this may create downtime and require effort, it adds a layer of security by preventing malicious integrations from accessing your HubSpot information with your existing API key.
To access your API key:
- In your HubSpot account, click the settings icon settings in the main navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- If a key has never been generated for your account, click Generate API key.
- If you've already generated an API key, click Show to display your key.
- With the key displayed, click Copy to copy the key. You can then paste the key to provide it to your developers, or use it in your integrations.
- To update your HubSpot API key:
- Click the Actions dropdown menu.
- To rotate key, select Rotate key and click Rotate and expire this key now. Select the reCAPTCHA checkbox. Your existing key will be deactivated and a new API key created. API calls using the deactivated HubSpot API key will now fail and any application using the key will no longer be able to access your information. Click Copy and replace the deactivated API key used by your integrations with this new API key to give them access to your information.
- To deactivate key, select Deactivate key and click Deactivate this key now. Select the reCAPTCHA checkbox. API calls using the deactivated HubSpot API key will now fail and any application using the key will no longer be able to access your information.
- View a dated log of users who’ve viewed, created, or deactivated the account’s API key in the Audit log section.