# Webhook without OAuth flow

**URL:** <https://community.hubspot.com/t/webhook-without-oauth-flow/15057>\
**Category:** APIs & Integrations\
**Tags:** oauth, webhooks\
**Created:** [June 30, 2019, 9:04pm UTC](https://community.hubspot.com/t/webhook-without-oauth-flow/15057 "2019-06-30T21:04:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lc\_dan](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/lc_dan/32/30191_2.png) [@lc\_dan](https://community.hubspot.com/u/lc_dan)\
**Post date:** [June 30, 2019, 9:04pm UTC](https://community.hubspot.com/t/webhook-without-oauth-flow/15057/1 "2019-06-30T21:04:28Z")

</div>

I am developing an in-house app for Hubspot, so I use the API key approach instead of the OAuth one.

Is this possible to subscribe and receive webhooks without going through the OAuth flow?

The following (from [Webhooks API Overview](https://developers.hubspot.com/docs/methods/webhooks/webhooks-overview)) seems to imply that OAuth is required:

“Webhooks are set up for a HubSpot app, not individual portals. Any portals that install your app ( **by going through the OAuth flow** ) will be subscribed to any webhook subscriptions set up for the app.”

Can anyone confirm?

---

<div class="post-metadata">

**Author:** ![IsaacTakushi](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/isaactakushi/32/70387_2.png) [@IsaacTakushi](https://community.hubspot.com/u/IsaacTakushi)\
**Post date:** [July 1, 2019, 7:42pm UTC](https://community.hubspot.com/t/webhook-without-oauth-flow/15057/2 "2019-07-01T19:42:39Z")

</div>

Welcome, [@lc\_dan](https://community.hubspot.com/t5/user/viewprofilepage/user-id/98384).

I can confirm that only OAuth apps can leverage [webhook subscriptions](https://developers.hubspot.com/docs/methods/webhooks/webhooks-overview).

Once you [create your app](https://developers.hubspot.com/docs/faq/how-do-i-create-an-app-in-hubspot) , however, you will only need to go through the [OAuth flow](https://developers.hubspot.com/docs/methods/oauth2/initiate-oauth-integration) _once_ to connect the integration, provided you have infrastructure to [refresh access tokens](https://developers.hubspot.com/docs/methods/oauth2/refresh-access-token) every six hours.  
Plenty of customers use OAuth apps for their in-house integrations.

---

<div class="post-metadata">

**Author:** ![lc\_dan](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/lc_dan/32/30191_2.png) [@lc\_dan](https://community.hubspot.com/u/lc_dan)\
**Post date:** [July 1, 2019, 11:47pm UTC](https://community.hubspot.com/t/webhook-without-oauth-flow/15057/3 "2019-07-01T23:47:29Z")

</div>

Thanks!

Just to clarify your last statement about “infrastructure to refresh access tokens”.

Do you mean that unless an access token is refreshed before expiry, the webhooks are not going to fire? I was planning on only refreshing when a webhook is received in order to get more data.

---

<div class="post-metadata">

**Author:** ![IsaacTakushi](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/isaactakushi/32/70387_2.png) [@IsaacTakushi](https://community.hubspot.com/u/IsaacTakushi)\
**Post date:** [July 2, 2019, 5:04pm UTC](https://community.hubspot.com/t/webhook-without-oauth-flow/15057/4 "2019-07-02T17:04:06Z")

</div>

Hi, [@lc\_dan](https://community.hubspot.com/t5/user/viewprofilepage/user-id/98384).

Thanks for bringing this up — I should have been clearer.

Webhook notifications will continue to fire as long as your app is connected. You do _not_ need up-to-date access tokens to _receive_ these requests. Thus, if your app passively listens for notifications, you could complete the OAuth flow once and never refresh your access tokens.

If you wish to request or manipulate any data, however, you will need to refresh access tokens.