# Storing API Keys for a public app

**URL:** <https://community.hubspot.com/t/storing-api-keys-for-a-public-app/137123>\
**Category:** APIs & Integrations\
**Tags:** developer-tools\
**Created:** [July 30, 2025, 11:59am UTC](https://community.hubspot.com/t/storing-api-keys-for-a-public-app/137123 "2025-07-30T11:59:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PaulBattisson](https://avatars.discourse-cdn.com/v4/letter/p/6bbea6/32.png) [@PaulBattisson](https://community.hubspot.com/u/PaulBattisson)\
**Post date:** [July 30, 2025, 11:59am UTC](https://community.hubspot.com/t/storing-api-keys-for-a-public-app/137123/1 "2025-07-30T11:59:41Z")

</div>

Hi everyone

I am working on a public app that acts as a bridge between HubSpot and a third-party API. This API requires some API keys from the user which ideally I want to store securely in HubSpot and pass through to my app if needed. I can see in private apps you can have secrets ([Workflows | Custom Code Actions - HubSpot docs](https://developers.hubspot.com/docs/reference/api/automation/custom-code-actions#secrets)). Is there a similar option for public apps?

Thanks for any ideas or help!

Paul

---

<div class="post-metadata">

**Author:** ![BrandonWoodruff](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/brandonwoodruff/32/61045_2.png) [@BrandonWoodruff](https://community.hubspot.com/u/BrandonWoodruff)\
**Post date:** [July 30, 2025, 1:13pm UTC](https://community.hubspot.com/t/storing-api-keys-for-a-public-app/137123/2 "2025-07-30T13:13:27Z")

</div>

Hey Paul, Public apps don’t support secrets. I suggest storing user keys externally in a secure store of some type:

#### 

**1. Create a Secure BE**

Stand up a secure backend or cloud function that:

- Stores user-specific API keys securely (e.g., encrypted in a database)
- Maps each HubSpot account by portalId or userId
- Can proxy or inject the keys when calling the 3rd-party API

**2. During app install, store the portalId**

When a user installs your app via OAuth, the **access token response includes the portal ID** :

{ “access\_token”: “…”, “refresh\_token”: “…”, “hub\_id”: 123456 }

You can then use that hub\_id to map user-specific credentials in your system.

#### 

**3. Create a secure FE UI in your app**

Use a HubSpot app settings page or an embedded iframe (like a CRM card or settings tab) to allow users to **enter their third-party API key** securely into your system.

You’ll:

- Authenticate the user via OAuth token or signed request
- Store their API key server-side (encrypted)
- Retrieve the key **only when needed** , server-to-server

Let me know if this helps, or if you have any other questions!

* * *

✔ Was I able to help answer your question? Help the community by **marking it as a solution.**

| ![](https://d2qpr2jzcazej7.cloudfront.net/original/3X/d/3/d314478a36473977ed45320812b9331d25e0d3c4.jpeg) | **[Brandon Woodruff](https://www.linkedin.com/in/brandon-woody-woodruff/)**  
Senior Software Developer @ [Pearagon](https://www.pearagon.com/)Still have questions? Reach out at [brandon@pearagon.com](mailto:brandon@pearagon.com) ![](https://d2qpr2jzcazej7.cloudfront.net/original/3X/d/c/dcad77e6cf96145dd117147531ae4423b9b5cd91.png) |

* * *

---

<div class="post-metadata">

**Author:** ![PaulBattisson](https://avatars.discourse-cdn.com/v4/letter/p/6bbea6/32.png) [@PaulBattisson](https://community.hubspot.com/u/PaulBattisson)\
**Post date:** [July 30, 2025, 1:22pm UTC](https://community.hubspot.com/t/storing-api-keys-for-a-public-app/137123/3 "2025-07-30T13:22:34Z")

</div>

Thanks Brandon, I assumed it would need this - it’s a shame as secure secrets for public apps exist on other platforms and I was hoping to utilise something like that to increase security in general. Thanks for the confirmation!