# PRIVATE\_APP\_ACCESS\_TOKEN format change? **URL:** \ **Category:** Develop, Build & Integrate\ **Tags:** developer\ **Created:** [June 30, 2026, 7:46am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661 "2026-06-30T07:46:32Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![JDean162](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@JDean162](https://community.hubspot.com/u/JDean162)\ **Post date:** [June 30, 2026, 7:46am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/1 "2026-06-30T07:46:32Z")
Hi Huspot community! Yesterday, I realized that the process.env.PRIVATE\_APP\_ACCESS\_TOKEN in my private app has changed format. and is no longer pat-xxx, but looks more like a hash variable [token]… Has anyone else seen this ? Or is it just me ? Thanks for any feedback 🙂 _Moderator note: For information, the HubSpot Community is a public space. I have therefore edited your content for security & confidential reasons._ ---
**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\ **Post date:** [June 30, 2026, 9:25am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/3 "2026-06-30T09:25:16Z")
Hey @JDean162, I hope that you are well! Great question, thanks for asking the HubSpot Community! To start with, it’s important to keep your account secure, so **please revoke that token** right away since it’s been shared here. You can do this by heading to Settings \> Integrations \> Private Apps, locating your app, and [rotating the token](https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview#rotate-your-access-token). About the format change, this is actually due to [Service Keys](https://developers.hubspot.com/changelog/service-keys), an exciting new authentication option that’s been available in public beta since February 10, 2026. Service Keys are gradually replacing legacy private apps for system-to-system integrations, making things more streamlined and secure moving forward! Hey @Anton, @nickdeckerdevs1 and @SteveHTM have you also seen this change of format in your accounts? Do you have any insights to share with @JDean162, please? Thanks so much and have a wonderful day! Bérangère _This post was created with the assistance of AI tools_ ---
**Author:** ![JDean162](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@JDean162](https://community.hubspot.com/u/JDean162)\ **Post date:** [June 30, 2026, 12:21pm UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/4 "2026-06-30T12:21:25Z")
Hi Berangere, I only shared my first few characters of my token, but ok i can rotate it. So to verify calls from Hubspot to my external application, i need to setup a THIRD\_PARTY\_ACCESS\_TOKEN and then verify this Token App? Because before, I was using the PRIVATE\_APP\_ACCESS\_TOKEN and hashing both sides. So if I only want to use API calls from now on, I should use a Service Key ? ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [July 7, 2026, 10:26am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/5 "2026-07-07T10:26:24Z")
Automatically bumped on July 7, 2026, 10:26am UTC ---
**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\ **Post date:** [July 9, 2026, 3:19pm UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/6 "2026-07-09T15:19:47Z")
Hi @JDean162 and thanks for following up! To reply to your questions: - HubSpot’s legacy private app token format (pat-xxx) is being replaced by Service Keys, which are the newer and more secure option (currently in public beta). If you notice your token now appears as a hash or bearer token, it likely means your private app token was rotated or you’re now seeing the new credential format. - Remember, the [PRIVATE\_APP\_ACCESS\_TOKEN](https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview) is only for you to call HubSpot’s API, it’s not used to confirm that requests coming into your app are truly from HubSpot. To verify inbound requests (like webhooks), HubSpot uses the X-HubSpot-Signature header, which is built using your app’s client secret and the request details via an SHA-256 hash. - Regarding using Service Keys moving forward, yes! If your integration only needs to make API calls (and you don’t require [webhooks](https://developers.hubspot.com/docs/apps/legacy-apps/authentication/validating-requests)), then Service Keys are the recommended, modern solution. You can manage them in Settings \> Integrations \> Service Keys and use them as a Bearer token. If you rely on webhooks, you’ll still need to use a project-based app or stick with a legacy private app for now. I hope this helps! Bérangère _This post was created with the assistance of AI tools_ ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [July 10, 2026, 7:00am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/7 "2026-07-10T07:00:45Z")
Automatically bumped on July 10, 2026, 7:00am UTC ---
**Author:** ![JDean162](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@JDean162](https://community.hubspot.com/u/JDean162)\ **Post date:** [July 15, 2026, 1:27pm UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/8 "2026-07-15T13:27:46Z")
Hi Berangere, Thanks for the info! So just to clarify: Even though i have a new 2026.03 project (as i need Webhooks), I now need to create a Service Key to call Hubspot from my app ? Kind regards, James ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [July 15, 2026, 2:45pm UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/9 "2026-07-15T14:45:42Z")
Automatically bumped on July 15, 2026, 2:45pm UTC ---
**Author:** ![Berangere](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/berangere/32/220784_2.png) [@Berangere](https://community.hubspot.com/u/Berangere)\ **Post date:** [July 15, 2026, 4:03pm UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/10 "2026-07-15T16:03:55Z")
Hey @JDean162 and thanks for getting back to me! To answer your question, yes, since you have a 2026.03 project app for webhooks, you should use a [Service Key](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/account-service-keys) for your outbound API calls to HubSpot. I hope this helps! Have a wonderful day! Bérangère _This post was created with the assistance of AI tools_ ---
**Author:** ![system](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/system/32/124_2.png) [@system](https://community.hubspot.com/u/system)\ **Post date:** [July 16, 2026, 7:00am UTC](https://community.hubspot.com/t/private-app-access-token-format-change/151661/11 "2026-07-16T07:00:04Z")
Automatically bumped on July 16, 2026, 7:00am UTC