Last updated: June 28, 2023
Available with any of the following subscriptions, except where noted:
All products and plans
|
With the HubSpot API key, your developers can create custom applications with HubSpot’s APIs. Each key is specific to a HubSpot account, not an individual user, and only one key is allowed at a time.
Please note: as of November 30, 2022, HubSpot API Keys are being deprecated and are no longer supported. Instead, you'll need to authenticate using a private app access token or OAuth. Learn more about this change and how to migrate an API key integration to use a private app instead.
If you're seeing a banner in your account about deactivating your API key:
- Ensure that you've migrated all impacted integrations, then deactivate the API key.
- To check if the account's API key has been used in the past seven days, you can view your API key call log history. The call log will not show any requests made with the key more than seven days ago.
- Apps listed on the Connected apps page of your account settings do not need to be migrated, as they authenticate with OAuth.
- Developer API keys are separate from standard HubSpot API keys, and are not being deprecated. Developer API keys are used for managing settings related to your HubSpot apps, including webhooks API subscriptions and timeline events API event types.
Access your API key
You must have Super Admin permissions to access your account's API key.
- In your HubSpot account, click the settings icon in the top navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- If a key has never been generated for your account, click Generate API key.
- If you've already generated an API key, click Show to display your key.
- With the key displayed, click Copy to copy the key. You can then paste the key to provide it to your developers or use it in your applications.
Rotate your API key
Providing your API key to a developer will give them full access to make changes to your account through HubSpot's API, including reading logged emails from connected email accounts and other third-party data.
For added security, consider rotating your HubSpot API key every six months. Rotating your HubSpot API key will deactivate the existing API key and generate a new one. HubSpot will display the age of the API key and recommend when you should rotate your API key.
Email notifications are sent every 180 days to super admins and users who last created or rotated the API key if the API key has not been rotated in that timeframe.
While this may create downtime and require effort, it adds a layer of security by preventing malicious applications from accessing your HubSpot information with your existing API key.
To rotate your HubSpot API key:
- In your HubSpot account, click the settings icon in the main navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- Click the Actions dropdown menu, then select Rotate key.
- Click Rotate and expire this key now. Select the reCAPTCHA checkbox. Your existing key will be deactivated and a new API key will be created.
- Click Copy and replace the deactivated API key used by your applications with this new API key.
API calls using the deactivated HubSpot API key will now fail and any application using the key will no longer be able to access your information.
Rotating your API key will not affect your connection with the Salesforce integration. However if you have a custom integration installed, you will need to update your API key after you rotate it.
Please note: Connected apps installed through the App Marketplace will not be affected when you rotate your API key.
Deactivate your API key
Deactivating your API key will not create a new key. API calls using the deactivated HubSpot API key will fail and any application using the key will no longer be able to access your information.
To deactivate your API key:- In your HubSpot account, click the settings icon in the top navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- Click the Actions dropdown menu.
- Click Deactivate key and click Deactivate this key now. Select the reCAPTCHA checkbox.
View your API audit log
You can view a dated log of users who’ve viewed, created, or deactivated your account’s API key in the Audit log section.
- In your HubSpot account, click the settings icon in the top navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- Click the Audit log tab.
View your API key call log
To help you debug one of your integrations or to ensure you’re complying with HubSpot’s API usage guidelines, you can view a log of your API key calls for the previous 7 days.
- In your HubSpot account, click the settings icon in the top navigation bar.
- In the left sidebar menu, navigate to Integrations > API key.
- In the Call log tab, view all activity for the past 7 days.
