Clarification Needed on OAuth Client Secret Rotation Impact on Existing Installations

Developer Support APIs & Integrations
,
1

Hello HubSpot Developer Community,

I’m currently integrating HubSpot CRM OAuth into our application and had a question regarding client secret rotation and its impact on existing installations.

We have a public HubSpot app using OAuth authentication. The app is already installed across multiple HubSpot accounts, and access tokens are being generated successfully.

If we rotate the client secret from the HubSpot Developer Portal:

  1. Will existing installed accounts continue to function with already issued refresh tokens and access tokens?
  2. Do previously generated refresh tokens remain valid after secret rotation?
  3. Is reauthorization required for users who have already connected their HubSpot accounts?
  4. Are there any recommended best practices to perform secret rotation without disrupting active integrations?

We want to rotate secrets as part of security best practices while ensuring there is no downtime or broken OAuth connections for existing customers.

If anyone has experience with this process or official guidance, I would really appreciate your insights.

Thank you in advance!

2

Hi @PramodK :waving_hand:

I haven’t been able to find anything specific in HubSpot docs relating to what happens to existing refresh tokens and access tokens when you rotate a Public App’s Client Secret. There are a fair few related posts in the community already that you may have already reviewed:

  1. https://community.hubspot.com/t5/APIs-Integrations/Rotating-our-client-secret/td-p/835643
  2. https://community.hubspot.com/t5/APIs-Integrations/Need-to-Rotate-Client-Secret-for-Public-App/m-p/1194117
  3. https://community.hubspot.com/t5/APIs-Integrations/Help-on-Oauth2-Client-Secret-Rotation/td-p/1133322
  4. https://community.hubspot.com/t5/APIs-Integrations/Rotating-public-app-client-secret/m-p/1166329
  5. https://community.hubspot.com/t5/APIs-Integrations/Need-to-Rotate-Client-Secret-for-Public-App/m-p/1196984

As this will require manual intervention from HubSpot, I suggest you raise these questions directly with HubSpot when you make the request for Public App Client Secret rotation.

I hope this proves helpful. Please let me know if you have any follow-up questions.

3

Hi @zach_threadint , how can we reach out to Hubspot directly

4

Hello @PramodK,
Welcome to the Community! Also, huge thanks to @zach_threadint for your help so far!

If you have access to Support I’d suggest reaching out to them by following these steps here.

I hope this helps!

Sam, Community Manager

5

@PramodK Try submitting an App Support Request.

I hope that proves helplful. Please let me know if you have any follow-up questions.