# \[Auth\] API key vs OAuth **URL:** \ **Category:** APIs & Integrations\ **Tags:** oauth\ **Created:** [April 13, 2021, 6:43am UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399 "2021-04-13T06:43:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hari0](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/hari0/32/22307_2.png) [@hari0](https://community.hubspot.com/u/hari0)\ **Post date:** [April 13, 2021, 6:43am UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/1 "2021-04-13T06:43:30Z")
HubSpot supports API keys and OAuth as per the documentation. But the OAuth is a 3-legged OAuth and needs the user to complete the Auth process. This makes it not possible to initiate the OAuth from the backend. We can complete the OAuth flow from the frontend and then pass the Auth token and refresh token to the backend. But the current Auth capability suggests that OAuth was made for frontend-based HubSpot integrations. Can we use the API key from multiple users? Wanted to clarify since the below is mentioned in the Auth document (ref : [Accounts Dashboard | HubSpot](https://developers.hubspot.com/docs/api/intro-to-auth%F0%9F%98%9E) `HubSpot's APIs allow two means of authentication: OAuth and API keys. While most endpoints support both methods (unless the documentation for a specific endpoint says otherwise), OAuth is generally recommended. API keys are good for rapid prototyping or integrations designed for single-account use, but any integration designed for multi-customer use or listing on the App Marketplace must be built as an app using HubSpot’s OAuth protocol. ` Is this a recommendation or is it mandatory? ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [April 13, 2021, 6:31pm UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/2 "2021-04-13T18:31:34Z")
Hey @hari0 It is a recommendation currently, but we highly advise against it and it will not be allowed on the marketplace. Personally, I back away any time my api key is asked for. ---
**Author:** ![hari0](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/hari0/32/22307_2.png) [@hari0](https://community.hubspot.com/u/hari0)\ **Post date:** [April 14, 2021, 7:25am UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/3 "2021-04-14T07:25:19Z")
Hi @dennisedson Thanks for the reply Do you suggest using OAuth from the frontend and then pass the OAuth token and refresh token to the backend ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [April 14, 2021, 3:03pm UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/4 "2021-04-14T15:03:22Z")
Sounds about right to me. @lynton might have some more in depth thoughts ---
**Author:** ![lynton](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/lynton/32/31184_2.png) [@lynton](https://community.hubspot.com/u/lynton)\ **Post date:** [April 14, 2021, 3:11pm UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/5 "2021-04-14T15:11:41Z")
Yes that’s correct. Initiate OAuth from the frontend, then share the tokens and refresh the tokens from the backend. The user only needs to authorize once, then the backend can refresh the token ongoing. ---
**Author:** ![hari0](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/hari0/32/22307_2.png) [@hari0](https://community.hubspot.com/u/hari0)\ **Post date:** [April 15, 2021, 9:09am UTC](https://community.hubspot.com/t/auth-api-key-vs-oauth/35399/6 "2021-04-15T09:09:45Z")
Hi @lynton , Thanks for the confirmation.