# How to use Secrets with Python custom code automation

**URL:** <https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588>\
**Category:** APIs & Integrations\
**Created:** [July 8, 2022, 9:46am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588 "2022-07-08T09:46:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![anewhubspotuser](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@anewhubspotuser](https://community.hubspot.com/u/anewhubspotuser)\
**Post date:** [July 8, 2022, 9:46am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/1 "2022-07-08T09:46:52Z")

</div>

How can I access secrets in a python custom code element? The example given is in js…

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [July 11, 2022, 10:46pm UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/2 "2022-07-11T22:46:41Z")

</div>

Hey, @anewhubspotuser 👋 Thanks for reaching out. Can you link us to the specific page and example you are referring to, please?  
I found some resources to help get us started:

- [Refresh OAuth 2.0 access token](https://legacydocs.hubspot.com/docs/methods/oauth2/refresh-access-token)
- [How to get HubSpot API key and Access Token](https://www.jeevangupta.com/getting-started-with-hubspot-api-hubspot-api-key-and-access-token/)
- This post from a community member (thanks @taran42 🙌) covering a similar request — [Update secrets value using custom code](https://community.hubspot.com/t5/APIs-Integrations/Update-secrets-value-using-custom-code/m-p/656820#M54464)

Thank you for the additional information! — Jaycee

---

<div class="post-metadata">

**Author:** ![anewhubspotuser](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@anewhubspotuser](https://community.hubspot.com/u/anewhubspotuser)\
**Post date:** [July 12, 2022, 11:16am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/3 "2022-07-12T11:16:46Z")

</div>

I am referring to [Workflows | Custom Code Actions - HubSpot docs](https://developers.hubspot.com/docs/api/workflows/custom-code-actions#:~:text=Once%20added%2C%20the%20secrets%20will%20be%20available%20as%20environment%20variables%2C%20which%20you%20can%20access%20in%20the%20custom%20code%2C%20as%20shown%20below%3A) . There is only a js example for handling secrets.

---

<div class="post-metadata">

**Author:** ![bdithberry](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/bdithberry/32/197834_2.png) [@bdithberry](https://community.hubspot.com/u/bdithberry)\
**Post date:** [February 25, 2023, 5:48pm UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/4 "2023-02-25T17:48:58Z")

</div>

HubSpot has it in their [documentation](https://developers.hubspot.com/docs/api/workflows/custom-code-actions) under the Get Started section in the Python code example, but when I used their code it didn’t work. I tried the below code and you can access a secret using it.  
Replace SECRET\_KEY in the code with your own.

```lia-code-sample
import os
from hubspot import HubSpot

def main(event):
 api = os.environ.get('SECRET_KEY')

```

---

<div class="post-metadata">

**Author:** ![Neem](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@Neem](https://community.hubspot.com/u/Neem)\
**Post date:** [September 1, 2026, 11:10am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/5 "2026-09-01T11:10:48Z")

</div>

I need Help to fix the token which was edited by mistake. Because of this all my automated whatsapp messages are stopped working

---

<div class="post-metadata">

**Author:** ![Neem](https://avatars.discourse-cdn.com/v4/letter/n/5fc32e/32.png) [@Neem](https://community.hubspot.com/u/Neem)\
**Post date:** [September 1, 2026, 11:24am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/6 "2026-09-01T11:24:59Z")

</div>

I do not have any coding knowledge. I took support from breeze assistant to create a associated property’s value in course. It created the workflow and required property and suggested me add legacy apps and service keys and i did step by step but it didnt work then it told me to edit the token. After that my all automated whatsapp messages stopped working. when crosschecked the token was using for all these messages. Breeze sent just sorry message and support team is telling they cant help as it is custom coding. I am fully in tension now. Can anyone help me to solve this issue ?

---

<div class="post-metadata">

**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\
**Post date:** [September 1, 2026, 11:56am UTC](https://community.hubspot.com/t/how-to-use-secrets-with-python-custom-code-automation/60588/8 "2026-09-01T11:56:12Z")

</div>

Hi @Neem and welcome, it’s a pleasure to have you on the HubSpot Community!

I can see why this feels urgent with all your automated WhatsApp messages stopped. Let’s narrow down exactly where the token was changed.

Please don’t share the token, service keys, or screenshots containing credentials publicly, and avoid making further changes for now. Could you confirm:

- Where the token was edited: a private app, workflow secret/custom-code action, or WhatsApp integration
- Which WhatsApp provider/app you use
- The exact error message, with sensitive details hidden

Here’s what’s likely happening: when you “edited the token,” you may have **rotated** the legacy app’s access token. Rotating creates a _new_ token and starts expiring the _old_ one. If your WhatsApp automation (workflow/integration) was still configured with the **old** token, it would now fail authentication, that matches what you’re seeing.

**How to fix it:**

1. In your HubSpot account, go to **Development → Legacy apps**.
2. Click the name of the private app used for both the property automation and your WhatsApp integration.
3. On the **Auth** tab, check the current, active access token.
4. If you see a pending rotation, you can click **Cancel rotation,** this cancels the expiration of the original token and revokes the newer one, restoring the original.
5. Otherwise, copy the current active token and update it wherever your WhatsApp automation/integration references it (this part depends on where your WhatsApp tool stores the token, since it’s a third-party integration, you’d update it there).

Here are some resources that can help:

- [Legacy private apps - HubSpot docs](https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview)
- [Legacy apps - HubSpot docs](https://developers.hubspot.com/docs/apps/legacy-apps/overview)

Now, I’d love to hear from our Top Experts: Hi @Anton and @SteveHTM do you have any insights to share with @Neem, please?

Thanks so much and have a wonderful day!  
Bérangère

_This post was created with the assistance of AI tools_