# Upcoming: API Key Sunset **URL:** \ **Category:** Developer Announcements\ **Tags:** api\ **Created:** [June 1, 2022, 4:44pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154 "2022-06-01T16:44:19Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Dadams](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dadams/32/21752_2.png) [@Dadams](https://community.hubspot.com/u/Dadams)\ **Post date:** [June 1, 2022, 4:44pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/1 "2022-06-01T16:44:19Z")
### What’s changing? API Keys have been [one of three authentication methods supported by HubSpot](https://developers.hubspot.com/docs/api/intro-to-auth) APIs. However, as part of ongoing efforts to protect our customer’s data, we will be sunsetting API Keys. As a result of this change, integrations will instead be required to work with [Private Apps](https://developers.hubspot.com/docs/api/private-apps). Private Apps offer tighter security and allow more granular control over your integrations and account data than legacy API keys. ### What this means for developers: With the introduction of Private Apps, users who previously developed on HubSpot and utilized API Keys will now be required to migrate existing integrations from using API Key authentication to using Private Apps instead. Instructions for how to migrate existing integrations can be found [here](https://developers.hubspot.com/docs/api/migrate-an-api-key-integration-to-a-private-app). ### Why the Change? Private Apps allow you to set up a separate static access token for each integration. Private App access tokens are also [scoped like OAuth access tokens](https://developers.hubspot.com/docs/api/working-with-oauth#scopes), so you can control the access that each integration has to your HubSpot account. Private Apps work much the same as API key integrations do, with the main change being that they use a static access token in the Authorization HTTP header, instead of using the API key in a query parameter to authorize the API request. No other changes should be required of your integration aside from updating the authentication method. If your integration is intended to be used by multiple HubSpot accounts, you must update your integration to be a [Public App using OAuth 2.0](https://developers.hubspot.com/docs/api/working-with-oauth). Private Apps cannot be used for multi-account apps. OAuth 2.0 provides the same security features as Private Apps, but provides a much better experience for HubSpot users, allowing them to quickly connect their HubSpot account to your app without additional code. ### When is this change happening? After November 30, we will begin the process of deprecating API Keys and your API keys will no longer be supported by HubSpot. You will therefore be using API keys at your own risk. As of July 15, 2022, we no longer allowed new API keys to be created. Existing API keys will work until November 30th, but accounts which did not have an API key, as of July 15, 2022, will not have access to create a new API key. In order to begin using Private Apps immediately, please see the [documentation for Private Apps](https://developers.hubspot.com/docs/api/private-apps). _[Developer Account API Keys](https://developers.hubspot.com/docs/api/developer-tools-overview), for configuring public apps, will still be available for use in Developer Accounts after November 30, 2022 and will not be affected by the API Key Sunset._ The [migration guide linked above](https://developers.hubspot.com/docs/api/migrate-an-api-key-integration-to-a-private-app) will remain your source of truth for information and questions regarding the API key sunset. If you have a question which hasn’t been answered, reach out to Customer Support. _Updated October 18_ ---
**Author:** ![MLi9](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@MLi9](https://community.hubspot.com/u/MLi9)\ **Post date:** [June 1, 2022, 5:15pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/2 "2022-06-01T17:15:11Z")
There is no way to retrieve “quotes” with private app key. ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [June 1, 2022, 5:20pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/3 "2022-06-01T17:20:53Z")
@MLi9 If you are referencing the [Quotes object](https://developers.hubspot.com/docs/api/crm/quotes), this is available with private app authentication ---
**Author:** ![MLi9](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@MLi9](https://community.hubspot.com/u/MLi9)\ **Post date:** [June 1, 2022, 5:22pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/4 "2022-06-01T17:22:30Z")
Ok, that’s good to hear. I haven’t try it recently, but it does not work back in April ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [June 1, 2022, 5:23pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/5 "2022-06-01T17:23:43Z")
I double checked before posting that and I was able to retrieve quotes so you should be good to go 👍 ---
**Author:** ![louischausse](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/louischausse/32/18067_2.png) [@louischausse](https://community.hubspot.com/u/louischausse)\ **Post date:** [June 1, 2022, 7:31pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/6 "2022-06-01T19:31:27Z")
Woah! Huge change! How would authentication work in workflow custom code actions? Would we need to create a private app for that as well? ---
**Author:** ![louischausse](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/louischausse/32/18067_2.png) [@louischausse](https://community.hubspot.com/u/louischausse)\ **Post date:** [June 3, 2022, 10:26am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/7 "2022-06-03T10:26:43Z")
I just created a private app and it is very easy to use for custom code actions! Problem solved. ---
**Author:** ![GKenyon](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/gkenyon/32/43030_2.png) [@GKenyon](https://community.hubspot.com/u/GKenyon)\ **Post date:** [June 2, 2022, 1:21am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/8 "2022-06-02T01:21:23Z")
I have just deployed a windows service ( not an app ) for a client that uses an API Key aka HapiKey to syncronise data between their ERP and HubSpot. Will this just stop working at the end of November? ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [June 2, 2022, 8:40pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/9 "2022-06-02T20:40:10Z")
@GKenyon , Yes. you will need to migrate to a private app. [Here is a link to the migration guide](https://developers.hubspot.com/docs/api/migrate-an-api-key-integration-to-a-private-app) ---
**Author:** ![GKenyon](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/gkenyon/32/43030_2.png) [@GKenyon](https://community.hubspot.com/u/GKenyon)\ **Post date:** [June 3, 2022, 1:34am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/10 "2022-06-03T01:34:00Z")
Thanks Dennis, For the benefit of anyone else using C# and an API key to access the API from an external application this is all you will need to change. I created a private app - assigned scope and the creation generated a token. This is an excerpt from the original code (using RestSharp) hapiKey = “your\_api\_key”; // real app reads this from a config var client = new RestClient(baseURL); var request = new RestRequest(“crm/v3/objects/companies/”, Method.Get); request.AddQueryParameter(“hapikey”, hapiKey); // etc.. This is what you need to change. token = “your\_token”; // real app reads this from a config var client = new RestClient(baseURL); var request = new RestRequest(“crm/v3/objects/companies”, Method.Get); request.AddHeader(“Authorization”, "Bearer " + token); // etc. ---
**Author:** ![mchanner](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mchanner/32/29892_2.png) [@mchanner](https://community.hubspot.com/u/mchanner)\ **Post date:** [July 27, 2022, 5:00pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/11 "2022-07-27T17:00:23Z")
Thank you so much! ---
**Author:** ![GKenyon](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/gkenyon/32/43030_2.png) [@GKenyon](https://community.hubspot.com/u/GKenyon)\ **Post date:** [July 29, 2022, 1:09am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/12 "2022-07-29T01:09:03Z")
Happy it helped you 😊 ---
**Author:** ![mzweng](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mzweng/32/52390_2.png) [@mzweng](https://community.hubspot.com/u/mzweng)\ **Post date:** [June 2, 2022, 9:16am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/13 "2022-06-02T09:16:10Z")
We are using the HubSpot APIs and API keys within HubSpot’s serverless functions. How can we adapt to this change for this scenario? How can we implement a token-refresh, if there’s no persistence in the serverless environment? ---
**Author:** ![Mark\_Ryba](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mark_ryba/32/22744_2.png) [@Mark\_Ryba](https://community.hubspot.com/u/Mark_Ryba)\ **Post date:** [June 2, 2022, 2:11pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/14 "2022-06-02T14:11:59Z")
Hey @mzweng, you would still be able to use a static key, you would just need to generate a “private app” key with the correct scopes. Not a huge change, but still cumbersome if you support a large number of functions and portals. ---
**Author:** ![mzweng](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/mzweng/32/52390_2.png) [@mzweng](https://community.hubspot.com/u/mzweng)\ **Post date:** [June 2, 2022, 3:16pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/15 "2022-06-02T15:16:33Z")
Hi [@Mark\_Ryba](https://community.hubspot.com/t5/user/viewprofilepage/user-id/138856), ah, ok I see. That is good. Thank you very much! ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [June 2, 2022, 8:42pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/16 "2022-06-02T20:42:47Z")
@mzweng You can create a Private App with the needed scopes, store it as a secret (just like with API keys) and [make API calls](https://developers.hubspot.com/docs/api/private-apps#make-api-calls-with-your-app-s-access-token) with it. No need for token refresh 😀 edit -- just saw that Mark beat me to the punch! ---
**Author:** ![Kevin-C](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/kevin-c/32/34570_2.png) [@Kevin-C](https://community.hubspot.com/u/Kevin-C)\ **Post date:** [June 4, 2022, 5:07am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/17 "2022-06-04T05:07:59Z")
Really wish there was an answer here 🙃. I’m imagining that env variables would still be accessible via the secrets. So we are just generating a secret’s value from a different location. I could be wrong ---
**Author:** ![remingtonbegg](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/remingtonbegg/32/67650_2.png) [@remingtonbegg](https://community.hubspot.com/u/remingtonbegg)\ **Post date:** [June 2, 2022, 11:25am UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/18 "2022-06-02T11:25:40Z")
Respectfully, This is not enough time to be able to pivot for all of the clients for solutions providers. This is not a small change by any means but giving 6 months seems unfeasible and a big hit to service providers who (like us) have literally hundreds of custom apps and integrations amongst customers built leveraging the API over the years. For the record, I agree with the direction but a Great example of a major change and giving the ramp to implement changes would be how [google is announcing the change for GA4](https://support.google.com/analytics/answer/11583528). **PS: a heads up to partners should have happened before this was public knowledge.** ---
**Author:** ![louischausse](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/louischausse/32/18067_2.png) [@louischausse](https://community.hubspot.com/u/louischausse)\ **Post date:** [June 2, 2022, 12:33pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/19 "2022-06-02T12:33:11Z")
100% ! Couldn’t agree more with what you are mentioning. I would add that it is unclear how we would be doing things that require API key but is not an app: - One time job/request/script (such as create a custom object, or a datetime property, or a batch update or extract, test an API endpoint, etc.) - Custom code actions (workflows, chatbots) - Serverless functions Would we need to create a private app for every small task? That doesn’t make sense… ---
**Author:** ![Skipio](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/skipio/32/3682_2.png) [@Skipio](https://community.hubspot.com/u/Skipio)\ **Post date:** [June 2, 2022, 2:23pm UTC](https://community.hubspot.com/t/upcoming-api-key-sunset/58154/20 "2022-06-02T14:23:35Z")
To add to your list: - webhook subscription management [Next page](https://community.hubspot.com/t/upcoming-api-key-sunset/58154.md?page=2)