topic Re: Upcoming: API Key Sunset in Developer Announcements

Upcoming: API Key Sunset

Dadams — Tue, 18 Oct 2022 15:10:49 GMT

What’s changing?

API Keys have been one of three authentication methods supported by HubSpot APIs. However, as part of ongoing efforts to protect our customer's data, we will be sunsetting API Keys.

As a result of this change, integrations will instead be required to work with Private Apps. Private Apps offer tighter security and allow more granular control over your integrations and account data than legacy API keys.

What this means for developers:

With the introduction of Private Apps, users who previously developed on HubSpot and utilized API Keys will now be required to migrate existing integrations from using API Key authentication to using Private Apps instead. Instructions for how to migrate existing integrations can be found here.

Why the Change?

Private Apps allow you to set up a separate static access token for each integration. Private App access tokens are also scoped like OAuth access tokens, so you can control the access that each integration has to your HubSpot account.

Private Apps work much the same as API key integrations do, with the main change being that they use a static access token in the Authorization HTTP header, instead of using the API key in a query parameter to authorize the API request. No other changes should be required of your integration aside from updating the authentication method.

If your integration is intended to be used by multiple HubSpot accounts, you must update your integration to be a Public App using OAuth 2.0. Private Apps cannot be used for multi-account apps. OAuth 2.0 provides the same security features as Private Apps, but provides a much better experience for HubSpot users, allowing them to quickly connect their HubSpot account to your app without additional code.

When is this change happening?

After November 30, we will begin the process of deprecating API Keys and your API keys will no longer be supported by HubSpot. You will therefore be using API keys at your own risk.

As of July 15, 2022, we no longer allowed new API keys to be created. Existing API keys will work until November 30th, but accounts which did not have an API key, as of July 15, 2022, will not have access to create a new API key.

In order to begin using Private Apps immediately, please see the documentation for Private Apps.

Developer Account API Keys, for configuring public apps, will still be available for use in Developer Accounts after November 30, 2022 and will not be affected by the API Key Sunset.

The migration guide linked above will remain your source of truth for information and questions regarding the API key sunset. If you have a question which hasn't been answered, reach out to Customer Support.

Updated October 18

Re: Upcoming: API Key Sunset

MLi9 — Wed, 01 Jun 2022 17:15:11 GMT

There is no way to retrieve "quotes" with private app key.

Re: Upcoming: API Key Sunset

dennisedson — Wed, 01 Jun 2022 17:20:53 GMT

@MLi9

If you are referencing the Quotes object, this is available with private app authentication

Re: Upcoming: API Key Sunset

MLi9 — Wed, 01 Jun 2022 17:22:30 GMT

Ok, that's good to hear. I haven't try it recently, but it does not work back in April

Re: Upcoming: API Key Sunset

dennisedson — Wed, 01 Jun 2022 17:23:43 GMT

I double checked before posting that and I was able to retrieve quotes so you should be good to go 👍

Re: Upcoming: API Key Sunset

louischausse — Wed, 01 Jun 2022 19:31:27 GMT

Woah! Huge change!

How would authentication work in workflow custom code actions? Would we need to create a private app for that as well?

Re: Upcoming: API Key Sunset

GKenyon — Thu, 02 Jun 2022 01:23:52 GMT

I have just deployed a windows service ( not an app ) for a client that uses an API Key aka HapiKey to syncronise data between their ERP and HubSpot. Will this just stop working at the end of November?

Re: Upcoming: API Key Sunset

mzweng — Thu, 02 Jun 2022 09:16:10 GMT

We are using the HubSpot APIs and API keys within HubSpot's serverless functions. How can we adapt to this change for this scenario?
How can we implement a token-refresh, if there's no persistence in the serverless environment?

Re: Upcoming: API Key Sunset

remingtonbegg — Thu, 02 Jun 2022 11:25:40 GMT

Respectfully, This is not enough time to be able to pivot for all of the clients for solutions providers. This is not a small change by any means but giving 6 months seems unfeasible and a big hit to service providers who (like us) have literally hundreds of custom apps and integrations amongst customers built leveraging the API over the years.
For the record, I agree with the direction but a Great example of a major change and giving the ramp to implement changes would be how google is announcing the change for GA4.

PS: a heads up to partners should have happened before this was public knowledge.

Re: Upcoming: API Key Sunset

louischausse — Thu, 02 Jun 2022 12:33:11 GMT

100% ! Couldn't agree more with what you are mentioning.

I would add that it is unclear how we would be doing things that require API key but is not an app:
- One time job/request/script (such as create a custom object, or a datetime property, or a batch update or extract, test an API endpoint, etc.)
- Custom code actions (workflows, chatbots)
- Serverless functions

Would we need to create a private app for every small task? That doesn't make sense...

Re: Upcoming: API Key Sunset

Mark_Ryba — Thu, 02 Jun 2022 14:11:59 GMT

Hey @mzweng, you would still be able to use a static key, you would just need to generate a "private app" key with the correct scopes. Not a huge change, but still cumbersome if you support a large number of functions and portals.

Re: Upcoming: API Key Sunset

ABerggren — Thu, 02 Jun 2022 14:16:30 GMT

This is very critical. As 6 months is not longe time. Espacially when 2 of those is summer. Im actiually interested if private apps actually always make the job done as an API can do? As all the one time/call jobs.

Re: Upcoming: API Key Sunset

Mark_Ryba — Thu, 02 Jun 2022 14:21:49 GMT

100% agree that this timeline is WAY too short. Those of us who have been in the ecosystem for a long time have built hundreds of one-off automation scripts, integrations, and serverless functions because OAuth didn't make sense if the project was only going to be used in a single portal. When Private App keys were announced I, like many others, moved to use those instead of API keys for new projects, but it was never implied that the universal keys would be going away and that we should start updating those old projects; even Stripe has a universal key for these kinds of use-cases. This is going to break a lot of the tools we HS power users and developers have built to add value to the platform, and we should have time to get in front of this change.

Re: Upcoming: API Key Sunset

Skipio — Thu, 02 Jun 2022 14:23:35 GMT

To add to your list:

- webhook subscription management

Re: Upcoming: API Key Sunset

Skipio — Thu, 02 Jun 2022 14:32:41 GMT

I use my developer api key in combination with an OAuth public app in order to create/manage webhooks, as the public app doesn't have a way to do this. How am I supposed to use the Webhooks API without an API Key?

The webhook api docs state that the only way to use the endpoints is with a "developer API key":

"You can use the following [webhook] endpoints and your developer API key to programmatically configure webhook settings for an app."

Emphasis added - source: https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api

Are you planning on adding a different way to authenticate against the webhook endpoints? 🤔

Re: Upcoming: API Key Sunset

Skipio — Thu, 02 Jun 2022 14:36:55 GMT

Wait, at the end of your post you have "Developer Account API Keys, for configuring public apps, will still be available for use in Developer Accounts"; does that apply to me for the webhook endpoints?

I'm confused on the difference between "API Keys", "Developer Account API Keys", and "Developer API Keys"... aren't they all the same?

Re: Upcoming: API Key Sunset

arlogilbert — Thu, 02 Jun 2022 15:02:04 GMT

The July date seems reasonable, but the November date is nowhere near enough notice.

HubSpot wants companies to build on top of your APIs which means that entire companies (mine included) have built on top of CMS/CRM/File APIs for myriad use cases across hundreds of services.

Given that replacing the API key is not as simple as just swapping out keys for the private app equivalent, but actually does require code level changes, this is nowhere near enough time to fully deprecate the keys. A year notice at a minimum would be acceptable.

Re: Upcoming: API Key Sunset

mzweng — Thu, 02 Jun 2022 15:16:33 GMT

Hi @Mark_Ryba, ah, ok I see. That is good. Thank you very much!

Re: Upcoming: API Key Sunset

gillytech — Thu, 02 Jun 2022 17:31:43 GMT

I am concerned that my Ecommerce Bridge implementation will stop working. Private Apps does not (AFAIK) support Ecommerce Bridge functions and it's the only thing I use API Keys for. Everything else is on Private Apps. What is the plan to provide Ecomm Bridge functionality in Private apps?

Re: Upcoming: API Key Sunset

TimMunro — Thu, 02 Jun 2022 20:29:32 GMT

Please clarify how to create custom objects without the API key. Object schema endpoints detailed here https://developers.hubspot.com/docs/api/crm/crm-custom-objects (e.g. POST/crm/v3/schemas) stipulate that only the API key may be used. Thanks, Tim