OAuth2 without a client secret? - OAuth2 Authorization Code w/PKCE Flow???

[IntegrationDev]

Hello,

Over the past year (since this post), have any options opened up for using OAuth2 with HubSpot without passing a client secret?

I'm working on an integration to HubSpot that is client hosted in a scenario somehwat similar to a single-page application (SPA).

Storing/using a client secret in this scenario is not ideal. It would be much better to use OAuth2's Authorization Code Flow with Proof Key for Code Exchange (PKCE), which avoids the need for that secret.

Hoping there's an option to do this. 🙂

In worse case, I may have to fall back to using private app registrations, but that may preclude my integration from being listed in the App Marketplace. 😞

Thank you!

[dennisedson · Accepted solution]

@IntegrationDev 

Apologies for the delayed response.  The answer in that post still holds true 😥

I would suggest creating an idea and posting the idea link on this thread for anyone else looking for this functionality to upvote it.

[dennisedson · Accepted solution]

@IntegrationDev 

Apologies for the delayed response.  The answer in that post still holds true 😥

I would suggest creating an idea and posting the idea link on this thread for anyone else looking for this functionality to upvote it.

[IntegrationDev · Accepted solution]

Thank you, @dennisedson! Done.

Here's the link to the Idea proposing this change: https://community.hubspot.com/t5/HubSpot-Ideas/OAuth2-Support-Authorization-Code-Flow-with-Proof-Key...