# Api validation

**URL:** <https://community.hubspot.com/t/api-validation/44383>\
**Category:** APIs & Integrations\
**Tags:** free, professional, webhooks\
**Created:** [September 27, 2021, 4:54am UTC](https://community.hubspot.com/t/api-validation/44383 "2021-09-27T04:54:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saikumar12](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/saikumar12/32/35926_2.png) [@Saikumar12](https://community.hubspot.com/u/Saikumar12)\
**Post date:** [September 27, 2021, 4:54am UTC](https://community.hubspot.com/t/api-validation/44383/1 "2021-09-27T04:54:54Z")

</div>

Hi Team,

I have a query how do I validate the API’s are actually coming from Hubspot or not. After integrated my app for Security

---

<div class="post-metadata">

**Author:** ![Teun](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/teun/32/28739_2.png) [@Teun](https://community.hubspot.com/u/Teun)\
**Post date:** [September 27, 2021, 5:35am UTC](https://community.hubspot.com/t/api-validation/44383/2 "2021-09-27T05:35:39Z")

</div>

Hi @Saikumar12 ,

If you have created a integration, the install URL will only work with HubSpot. I didn’t dive in the code that much to tell if it is not hackable. But the authentication part should only work with HubSpot. Which means that your tokens should only validate with HubSpot.

---

<div class="post-metadata">

**Author:** ![Saikumar12](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/saikumar12/32/35926_2.png) [@Saikumar12](https://community.hubspot.com/u/Saikumar12)\
**Post date:** [September 27, 2021, 5:54am UTC](https://community.hubspot.com/t/api-validation/44383/3 "2021-09-27T05:54:28Z")

</div>

After integration has been done how do I validate the API’s are coming from Hubspot after installed the application in HubSpot

---

<div class="post-metadata">

**Author:** ![Teun](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/teun/32/28739_2.png) [@Teun](https://community.hubspot.com/u/Teun)\
**Post date:** [September 27, 2021, 6:06am UTC](https://community.hubspot.com/t/api-validation/44383/4 "2021-09-27T06:06:36Z")

</div>

Hi @Saikumar12 ,

Hi @Saikumar12 ,

Check this [doc](https://developers.hubspot.com/docs/api/webhooks/validating-requests) , HubSpot uses a signature header which you can verify.

---

<div class="post-metadata">

**Author:** ![Saikumar12](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/saikumar12/32/35926_2.png) [@Saikumar12](https://community.hubspot.com/u/Saikumar12)\
**Post date:** [September 27, 2021, 6:08am UTC](https://community.hubspot.com/t/api-validation/44383/5 "2021-09-27T06:08:50Z")

</div>

Thank you