Client secret for webhook authentication

Develop, Build & Integrate APIs & Integrations
1

Previously we created a private app and used its app id to authenticate webhooks. Now the HubSpot UI does not expose the client secret that I need to validate the digital signature. That’s not a problem for existing uses - I know what the secret is. But I need to repeat this process in another new HubSpot instance. How do I get the client secret for a new private app? Or do I need to create a developer account to create an app that does nothing and that I’ll never use only to get a client secret that will allow me to authenticate a webhook?

2

Hi, @AndrewGallacher :waving_hand:. Thanks for reaching out. Let’s see if our community has any suggestions for accomplishing your goal – hey @LMeert do you have any experience here?

Thank you very much! – Jaycee

3

Hi @AndrewGallacher,

It really is confusing since they’re called private apps, but authentication works a little bit differently from the apps you can create in your developer account.
You should be able to authenticate your API calls by simply adding this to the header :

 {
 headers: {
 'Authorization': `Bearer ${YOUR_TOKEN}`,
 'Content-Type': 'application/json'
 }
 }

Basically it works like the Hapikey which you add as a query parameter, except that with the private apps you can restrain the scope of the token on a per app basis, which limits the risks.

However, if you do need to use webhooks, the private apps won’t be sufficient, as stated by the private apps documentation : webhooks are considered an advanced integration, and reserved for public apps only.

LMeert_0-1652858731032.png
LMeert_0-1652858731032.png940×421 25.9 KB

Hope this helps !
If it does, please consider marking this answer as a solution :slightly_smiling_face:

Best,

Ludwig

4

Hi @LMeert

Thanks for your reply. This does not address my issue. I am not wanting the private app to do anything and certainly not to call a webhook. I am trying to authenticate webhook calls to my external API by getting HubSpot to generate a digital signature. This requires an app. HubSpot uses the client secret of that app to generate the digital signature but I need to know what that secret is too so that I can validate the digital signature in requests hitting my endpoint.

This seems to have changed.

Thanks,

Andrew

5

Hey @AndrewGallacher,

I understand you want to subscribe to webhook notifications so your external API receives updates of what is happening within your Hubspot account, is that correct ?

I also imagine you follow the authentication instructions provided here to make sure the posts you’re receiving are indeed from Hubspot.

You’re also mentionning private apps, and to me it’s where it gets confusing.
Are you referring to private apps or simply an app on your developer account that is only being used by yourself.

If it’s the former, what I said still stands, cause webhooks subscriptions don’t work with private apps.

I’ve just read your initial post again and it looks like yes, the answer is : create an app with a developper account and subscribe to webhooks with it so you can follow the authentication instructions linked above (i.e. you can find the secret within the Hubspot Dev account UI).
Best,

Ludwig

6

Hi Ludwig,

Thanks again for taking time to answer my query.

Yes, I am trying to authenticate a webhook.

Yes, I am following the instructions provided but am struggling to locate client secret.

Yes, I am using a prviate app because we have been able to get this working before and still have instances of a private app being used to authenticate a webhook operating successfully now. My perception is that the app is merely providing a source for the client secret - we are not calling the private app or expecting it to call the webhook! I understand it won’t do that but that’s not what we are trying to do. What I’m really trying to do is get HubSpot to add a digital signature to a webhook request and to be able to validate that request.

Something has changed here!

So, I need to create an app (a non-private app) that does nothing and then install that in my instance. That way I can see how to access the client secret. Then, when I want to do the same on another instance of HubSpot I need to create another app so that I am not sharing secrets across instances. This seems over the top to me. I think HubSpot should have a better way of handling this.

Thanks for your help.

Andrew

7

Are you referring to webhooks action within the workflows or webhooks you can subscribe to in the developer portal ?

Webhooks in the developper portal:

You can include webhook subscription with every app you create; this way you will get notifications on your webhook(s) for every instance that installs the app. Sure the secret will be the same and shared by all the instanced your app will be installed onto, but it will never be accessible by the end user : only the developper has access to it.

If you want to install your app on several accounts, it’s fine since the messages you’ll get from Hubspot will specify which instance it’s coming from (see body example below from the )

[
 {
 "eventId": "100",
 "subscriptionId": 1596135,
 "portalId": 25195958,
 "occurredAt": 1652887172046,
 "subscriptionType": "contact.creation",
 "attemptNumber": 0,
 "objectId": 123,
 "changeSource": "CRM",
 "changeFlag": "NEW"
 }
]

I think this approach would be best so as to avoid setting up the workflows and webhooks on every account → installing the app (and going through the approval process) is enough to receive secured post requests to your webhook from said HubSpot account.

Webhooks as workflow action:

If you want to authenticate the webhook action in the workflows, then I think you are right that the only option is to make one app for every account as you compromise the secret of your app by making it available to every person with rights to edit the workflow.

I hope this helps you in some way, sorry about these questions but webhooks and apps being accessible/editable from both dev and regular accounts makes answering quite hard ! :slightly_smiling_face:

8

Hi Ludwig,

My apologies for joining in on this, but I am having the same issue. I’m sending a post request to a url on my website from a workflow, and I really just want to check that the request is being sent from my Hubspot account using the request signature that is available. I have got it to send the header to check, but I can’t check the header on the website end as I don’t know my client secret so cannot hash my own string to check against.

Is the solution really that I need to make a public app on a developer account, and connect this to my hubspot account, merely to check this? It seems very heavy handed as there is so much extra stuff to make a public app (and for good reason!), but isn’t that the point of the private apps?

Thanks,

Rachel