Last updated: June 28, 2023
With the HubSpot API key, your developers can create custom applications with HubSpot’s APIs. Each key is specific to a HubSpot account, not an individual user, and only one key is allowed at a time.
Please note: as of November 30, 2022, HubSpot API Keys are being deprecated and are no longer supported. Instead, you'll need to authenticate using a private app access token or OAuth. Learn more about this change and how to migrate an API key integration to use a private app instead.
If you're seeing a banner in your account about deactivating your API key:
You must have Super Admin permissions to access your account's API key.
Providing your API key to a developer will give them full access to make changes to your account through HubSpot's API, including reading logged emails from connected email accounts and other third-party data.
For added security, consider rotating your HubSpot API key every six months. Rotating your HubSpot API key will deactivate the existing API key and generate a new one. HubSpot will display the age of the API key and recommend when you should rotate your API key.
Email notifications are sent every 180 days to super admins and users who last created or rotated the API key if the API key has not been rotated in that timeframe.
While this may create downtime and require effort, it adds a layer of security by preventing malicious applications from accessing your HubSpot information with your existing API key.
To rotate your HubSpot API key:
API calls using the deactivated HubSpot API key will now fail and any application using the key will no longer be able to access your information.
Rotating your API key will not affect your connection with the Salesforce integration. However if you have a custom integration installed, you will need to update your API key after you rotate it.
Please note: Connected apps installed through the App Marketplace will not be affected when you rotate your API key.
Deactivating your API key will not create a new key. API calls using the deactivated HubSpot API key will fail and any application using the key will no longer be able to access your information.To deactivate your API key:
You can view a dated log of users who’ve viewed, created, or deactivated your account’s API key in the Audit log section.
To help you debug one of your integrations or to ensure you’re complying with HubSpot’s API usage guidelines, you can view a log of your API key calls for the previous 7 days.