Data drives connected unified experiences. As the sophistication of what you build grows, so does the need for easy to use yet secure ways to access that data. Previously, HubSpot’s 1:1 integration method was a single API Key, known as a HAPI key.
The Problem with HAPI Keys
HubSpot API Keys worked well, but came at a cost. The only way to connect a custom integration to a HubSpot account was to use the account’s API key. All integrations share the same key, meaning that all API requests for all integrations are grouped together for limits and monitoring. It also means that if the key needs to be rotated, it needs to be replaced in each integration separately. HubSpot API Keys also grant complete access to the data in a HubSpot account.
In essence, it’s kind of like having the same key for all the rooms in a hotel. Guests would feel uneasy knowing other guests could enter their rooms, and if one lock broke, every key would need to be changed. Obviously, this solution isn’t ideal.
Private Apps to the Rescue!
Until now, developers making HubSpot API calls in 1:1 use cases had to choose between the ease of use of API keys and the security and control of OAuth.
To make your portals more secure and your troubleshooting less of a hassle, we’re rolling out Private Apps, a safer and more user friendlier way for developers to create custom integrations with the HubSpot API. While API keys will still be supported, Private Apps deliver security and usability improvements that customers have been asking for.
Private Apps allow developers to set up a separate static access token for each integration. Each integration will have its own API call logging, allowing you to view API requests for a single integration. This also allows you to rotate the token for a single integration without impacting your other integrations and we made access token rotation easy by supporting two valid tokens at one time per Private App. Private App access tokens are also scoped like OAuth access tokens, so you can control the access that each integration has to your HubSpot account.
How Private Apps Work
To build a Private App, click the settings icon in your HubSpot account, then choose integrations > Private Apps. Click “Create private app.” On the Basic Info tab, you can name your app, upload an icon, and add a description.
The Scopes tab is where you’ll configure the app’s scopes and capabilities. Search for the scope you want your private app to access in the search bar, then select the “Write,” “Read,” or “Request” checkbox next to the desired scopes.
Click “Create app” in the top right, review the access token, and, voila! You’ve now created a Private App. Once created, you can start making API calls using the app’s access token. And because Private Apps are always user-friendly, you can edit your app at any time without impacting your other API connections.
If you’d like to learn more, view our developer documentation here