Storing API Keys for a public app

Develop, Build & Integrate APIs & Integrations
2

Hey Paul, Public apps don’t support secrets. I suggest storing user keys externally in a secure store of some type:

1. Create a Secure BE

Stand up a secure backend or cloud function that:

  • Stores user-specific API keys securely (e.g., encrypted in a database)
  • Maps each HubSpot account by portalId or userId
  • Can proxy or inject the keys when calling the 3rd-party API

2. During app install, store the portalId

When a user installs your app via OAuth, the access token response includes the portal ID:

{ “access_token”: “…”, “refresh_token”: “…”, “hub_id”: 123456 }

You can then use that hub_id to map user-specific credentials in your system.

3. Create a secure FE UI in your app

Use a HubSpot app settings page or an embedded iframe (like a CRM card or settings tab) to allow users to enter their third-party API key securely into your system.

You’ll:

  • Authenticate the user via OAuth token or signed request
  • Store their API key server-side (encrypted)
  • Retrieve the key only when needed, server-to-server

Let me know if this helps, or if you have any other questions!

:check_mark: Was I able to help answer your question? Help the community by marking it as a solution.

200×200 7.52 KB
Brandon Woodruff
Senior Software Developer @ PearagonStill have questions? Reach out at brandon@pearagon.com