Add secret key forbidden

[jjimeno]

Hi, 

Hope everyone is doing great!

We are trying to add an API key for our serverless function in hubspot throught CLI, however, after running hs secrets add {keyname} {apikey}

I am getting this error:

The post to "add secret" in portal was forbidden.

What could be the issue here?

Also, how do we make our api's in serverless functions only accessible through the Hubspot website and not elsewhere? 

Thank you!

Regards,
Jess

[jmclaren]

Hey @jjimeno ,

Can you first make sure you are using the latest version of the CMS CLI, by updating: https://developers.hubspot.com/docs/cms/developer-reference/local-development-cms-cli#upgrade

Then as for why you are getting that error, it's likely the personal access key you are using to authenticate with your CLI tools does not have the serverless functions scope. You'll need to go in to your account and make sure it has that permission checked.
View your personal access key permissions
What is a personal access key? 

Additionally the serverless functions permission, is only available in accounts that have access to serverless functions. That means CMS Hub Enterprise or developer sandbox accounts.

Regarding your second question, due to CORs you can only make requests from connected domains, with the exception of GET requests.

[jjimeno]

hi @jmclaren !

Thank you so much for the reply! 

Yes, I just updated the CMS CLI and followed the instructions to retrieve the personal CMS key. 

As for my second question, now we can access the API even if we call it through Postman for example. 

Our goal is not to expose the API and only accessible when its called from our site. 
Is it possible? 

Thank you!

[dennisedson]

Hello @jjimeno ,

Sorry for delayed response!  I noticed you also asked this question another thread ( I will answer there as well for anyone searching and comes across that post )

At this time, we do not have a good solution for limiting the access.  It has been mentioned several times and we are investigating so stay tuned.