[Auth] API key vs OAuth

Develop, Build & Integrate APIs & Integrations
1

HubSpot supports API keys and OAuth as per the documentation. But the OAuth is a 3-legged OAuth and needs the user to complete the Auth process. This makes it not possible to initiate the OAuth from the backend.

We can complete the OAuth flow from the frontend and then pass the Auth token and refresh token to the backend. But the current Auth capability suggests that OAuth was made for frontend-based HubSpot integrations.

Can we use the API key from multiple users?

Wanted to clarify since the below is mentioned in the Auth document (ref : Accounts Dashboard | HubSpot

HubSpot's APIs allow two means of authentication: OAuth and API keys. While most endpoints support both methods (unless the documentation for a specific endpoint says otherwise), OAuth is generally recommended. API keys are good for rapid prototyping or integrations designed for single-account use, but any integration designed for multi-customer use or listing on the App Marketplace must be built as an app using HubSpot’s OAuth protocol.

Is this a recommendation or is it mandatory?

2

Hey @hari0

It is a recommendation currently, but we highly advise against it and it will not be allowed on the marketplace.

Personally, I back away any time my api key is asked for.

3

Hi @dennisedson

Thanks for the reply

Do you suggest using OAuth from the frontend and then pass the OAuth token and refresh token to the backend

4

Sounds about right to me.

@lynton might have some more in depth thoughts

5

Yes that’s correct. Initiate OAuth from the frontend, then share the tokens and refresh the tokens from the backend. The user only needs to authorize once, then the backend can refresh the token ongoing.

6

Hi @lynton ,

Thanks for the confirmation.