API access and client_credentials flow alternatives

Develop, Build & Integrate APIs & Integrations
1

Hiya,

From what I understand it looks like Legacy Private Apps are being sunsetted (and as of June 23, 2026 can no longer be created), so I have been looking at creating an app in order to grant API access. However, from reading the documentation it sounds like the client_credentials OAuth flow is not supported for CRM scopes.

What is the preferred way to set up API access for server to server communication in order to perform CRM actions? Is it reasonable to assume that once an initial access token has been generated via the authorization_code flow, the refresh token cycle could be used to grant access tokens in perpetuity?

Thanks

3

Hi @richardmanifesto

Great question!

You’re right that Legacy Private Apps can no longer be created as of June 23, 2026, but the good news is there are still solid options for server-to-server CRM access.

The recommended approach: Private App with Static Auth

For server-to-server setups, you’ll want to use a private app with static authentication rather than an OAuth flow. On the new developer platform, you can create an app with auth.type: static and distribution: private in your app-hsmeta.json — this gives you a static access token scoped to a single account, no OAuth flow required.

On your authorization_code + refresh token idea

This can technically work, but it’s really designed for multi-tenant apps where users grant consent. The refresh token is a long-term credential, but it can be revoked and isn’t guaranteed to last forever. So for a pure server-to-server setup, it adds unnecessary complexity compared to static auth.

On client_credentials

You’re correct that client_credentials is not supported for CRM scopes — it’s only available for the webhooks journal API.

TL;DR: Static auth via a private app on the new developer platform is the cleanest path for what you’re trying to do.

Hope that helps! Let me know if you have any follow-up questions! :slightly_smiling_face:

Cassie, Community Manager

4

Hi @richardmanifesto
I hope you are doing well.

Legacy Private Apps are being phased out, and you’re right that client_credentials doesn’t work for CRM scopes. HubSpot’s new solution is Service Keys, the same simple experience as before (create a key, pick CRM scopes, use it as a Bearer token), but no OAuth setup and nothing to refresh. It just doesn’t support webhooks; if we need real-time push notifications later, we’d add a proper OAuth app for that piece only.

On your other question- yes, your understanding is correct: with OAuth, one initial login lets the refresh token keep generating new access tokens indefinitely.

Recommendation: go with a Service Key for now (currently in public beta) since it covers all our CRM needs. We can layer in OAuth later if webhooks come into play.

Reference Doc link: Make API requests using a service key (BETA) - HubSpot docs

I hope this helps you out. Please mark it as Solution Accepted and upvote to help another Community member.

Thanks!

5

Thanks @GRajput , that was very helpful :slightly_smiling_face:

6

Thanks @chighsmith , your response was very helpful :slightly_smiling_face: