PRIVATE_APP_ACCESS_TOKEN format change?

Develop, Build & Integrate
1

Hi Huspot community!
Yesterday, I realized that the process.env.PRIVATE_APP_ACCESS_TOKEN in my private app has changed format. and is no longer pat-xxx, but looks more like a hash variable
[token]…

Has anyone else seen this ? Or is it just me ?

Thanks for any feedback :slight_smile:

Moderator note: For information, the HubSpot Community is a public space. I have therefore edited your content for security & confidential reasons.

3

Hey @JDean162, I hope that you are well!

Great question, thanks for asking the HubSpot Community!

To start with, it’s important to keep your account secure, so please revoke that token right away since it’s been shared here. You can do this by heading to Settings > Integrations > Private Apps, locating your app, and rotating the token.

About the format change, this is actually due to Service Keys, an exciting new authentication option that’s been available in public beta since February 10, 2026. Service Keys are gradually replacing legacy private apps for system-to-system integrations, making things more streamlined and secure moving forward!

Hey @Anton, @nickdeckerdevs1 and @SteveHTM have you also seen this change of format in your accounts? Do you have any insights to share with @JDean162, please?

Thanks so much and have a wonderful day!
Bérangère

This post was created with the assistance of AI tools

4

Hi Berangere,
I only shared my first few characters of my token, but ok i can rotate it.

So to verify calls from Hubspot to my external application, i need to setup a THIRD_PARTY_ACCESS_TOKEN and then verify this Token App? Because before, I was using the PRIVATE_APP_ACCESS_TOKEN and hashing both sides.

So if I only want to use API calls from now on, I should use a Service Key ?

6

Hi @JDean162 and thanks for following up!

To reply to your questions:

  • HubSpot’s legacy private app token format (pat-xxx) is being replaced by Service Keys, which are the newer and more secure option (currently in public beta). If you notice your token now appears as a hash or bearer token, it likely means your private app token was rotated or you’re now seeing the new credential format.

- Remember, the PRIVATE_APP_ACCESS_TOKEN is only for you to call HubSpot’s API, it’s not used to confirm that requests coming into your app are truly from HubSpot. To verify inbound requests (like webhooks), HubSpot uses the X-HubSpot-Signature header, which is built using your app’s client secret and the request details via an SHA-256 hash.

  • Regarding using Service Keys moving forward, yes! If your integration only needs to make API calls (and you don’t require webhooks), then Service Keys are the recommended, modern solution. You can manage them in Settings > Integrations > Service Keys and use them as a Bearer token. If you rely on webhooks, you’ll still need to use a project-based app or stick with a legacy private app for now.

I hope this helps!

Bérangère

This post was created with the assistance of AI tools

8

Hi Berangere,

Thanks for the info!

So just to clarify:

Even though i have a new 2026.03 project (as i need Webhooks), I now need to create a Service Key to call Hubspot from my app ?

Kind regards,

James

10

Hey @JDean162 and thanks for getting back to me!

To answer your question, yes, since you have a 2026.03 project app for webhooks, you should use a Service Key for your outbound API calls to HubSpot.

I hope this helps!

Have a wonderful day!
Bérangère

This post was created with the assistance of AI tools