Cannot do searches with api key but can with OAuth

I tried using the api key method to list all contacts but I get an error saying that I do not have the correct permission.

import requests
import json
import urllib.parse
from hubspot import HubSpot
import hubspot
from pprint import pprint

max_results = 500
hapikey = ‘****************************’
count = 5
contact_list = []
get_all_contacts_url = “https://api.hubapi.com/contacts/v1/lists/all/contacts/all?
parameter_dict = {‘hapikey’: hapikey, ‘count’: count}
headers = {}

parameters = urllib.parse.urlencode(parameter_dict)
get_url = get_all_contacts_url + parameters
r = requests.get(url= get_url, headers = headers)
print(r.text)

{"status":"error","message":"This hapikey (eu1-b8c6-f564-4bf4-b94f-570d5565a1e0) does not have proper permissions! (requires all of [contacts-read])","correlationId":"fd5f5e02-9e08-45b5-aef6-32bea451a777"}

I then tried the oauth method. I authenticate and get the code needed.

GTobin_0-1666171483346.png

I then use this code along with the client id, secret to get the access token

from hubspot.auth.oauth import ApiException
from hubspot import HubSpot
from hubspot.crm.contacts import SimplePublicObjectInput
from hubspot.crm.contacts.exceptions import ApiException
from hubspot.auth.oauth import ApiException

api_client = HubSpot(access_token=‘***********************’)
try:
tokens = api_client.auth.oauth.default_api.create_token(
grant_type=“authorization_code”,
redirect_uri=‘http://localhost’,
client_id=‘******************************’,
client_secret=‘***************************’,
code=‘********************’
)
except ApiException as e:
print(“Exception when calling create_token method: %s\n” % e)
print(tokens)

{'access_token': 'CPGh4a29MBIHAAEAQAAAARituMUMIIvVvxYo6JFGMhQefnCJMmHc9BLziwmnA5VRQpe8ZjowAAAAQQAAAAAAAAAAAAAAAACAAAAAAAAAAAAAIAAAAAAA4AEAAAAAAAAAAAAAABACQhQd_P1KFLJc4_6QpjH1dbCPSVuSJUoDZXUxUgBaAA',
 'expires_in': 1800,
 'refresh_token': 'eu1-64fa-942a-49cf-bbdd-fc9cfb991c3e'}

I then use the access token and all contacts are returned

import hubspot
from pprint import pprint
from hubspot.crm.contacts import ApiException

client = hubspot.Client.create(access_token=“CPGh4a29MBIHAAEAQAAAARituMUMIIvVvxYo6JFGMhQefnCJMmHc9BLziwmnA5VRQpe8ZjowAAAAQQAAAAAAAAAAAAAAAACAAAAAAAAAAAAAIAAAAAAA4AEAAAAAAAAAAAAAABACQhQd_P1KFLJc4_6QpjH1dbCPSVuSJUoDZXUxUgBaAA”)

try:
api_response = client.crm.contacts.basic_api.get_page(limit=10, archived=False)
pprint(api_response)
except ApiException as e:
print(“Exception when calling basic_api->get_page: %s\n” % e)

{'paging': None,
 'results': [{'archived': False,
 'archived_at': None,
 'associations': None,
 'created_at': datetime.datetime(2022, 9, 29, 14, 56, 43, 828000, tzinfo=tzutc()),
 'id': '1',
 'properties': {'createdate': '2022-09-29T14:56:43.828Z',
 'email': 'emailmaria@hubspot.com',
 'firstname': 'Maria',
 'hs_object_id': '1',
 'lastmodifieddate': '2022-09-29T14:56:54.927Z',
 'lastname': 'Johnson (Sample Contact)'},
 'updated_at': datetime.datetime(2022, 9, 29, 14, 56, 54, 927000, tzinfo=tzutc())},
 {'archived': False,
 'archived_at': None,
 'associations': None,
 'created_at': datetime.datetime(2022, 9, 29, 14, 56, 44, 108000, tzinfo=tzutc()),
 'id': '51',
 'properties': {'createdate': '2022-09-29T14:56:44.108Z',
 'email': 'bh@hubspot.com',
 'firstname': 'Brian',
 'hs_object_id': '51',
 'lastmodifieddate': '2022-09-29T14:56:49.192Z',
 'lastname': 'Halligan (Sample Contact)'},
 'updated_at': datetime.datetime(2022, 9, 29, 14, 56, 49, 192000, tzinfo=tzutc())},
 {'archived': False,
 'archived_at': None,
 'associations': None,
 'created_at': datetime.datetime(2022, 10, 13, 15, 17, 4, 773000, tzinfo=tzutc()),
 'id': '101',
 'properties': {'createdate': '2022-10-13T15:17:04.773Z',
 'email': 'email@example.com',
 'firstname': None,
 'hs_object_id': '101',
 'lastmodifieddate': '2022-10-13T15:17:33.863Z',
 'lastname': None},
 'updated_at': datetime.datetime(2022, 10, 13, 15, 17, 33, 863000, tzinfo=tzutc())}]}

I cannot get this work using the api key method but can using the oauth method.

Hi @GTobin ,

First of all, I would advise you to hide your access tokens and API keys, as people could abuse this.
Second, I would advise against using the API key as they will no longer work starting November. You should definitely check out Private Apps instead. That way, you can skip the oAuth flow.