Webhook without OAuth flow

SOLVE
Highlighted
New Contributor

I am developing an in-house app for Hubspot, so I use the API key approach instead of the OAuth one.

 

Is this possible to subscribe and receive webhooks without going through the OAuth flow?

 

The following (from Webhooks API Overview) seems to imply that OAuth is required:

"Webhooks are set up for a HubSpot app, not individual portals. Any portals that install your app (by going through the OAuth flow) will be subscribed to any webhook subscriptions set up for the app."

 

Can anyone confirm?

Reply
0 Upvotes
1 Accepted solution

Accepted Solutions
HubSpot Moderator

Welcome, @lc_dan.

 

I can confirm that only OAuth apps can leverage webhook subscriptions.

 

Once you create your app , however, you will only need to go through the OAuth flow once to connect the integration, provided you have infrastructure to refresh access tokens every six hours.

Plenty of customers use OAuth apps for their in-house integrations.

Isaac Takushi

HubSpot Developer Support
Reply
0 Upvotes
3 Replies 3
HubSpot Moderator

Welcome, @lc_dan.

 

I can confirm that only OAuth apps can leverage webhook subscriptions.

 

Once you create your app , however, you will only need to go through the OAuth flow once to connect the integration, provided you have infrastructure to refresh access tokens every six hours.

Plenty of customers use OAuth apps for their in-house integrations.

Isaac Takushi

HubSpot Developer Support
Reply
0 Upvotes
New Contributor

Thanks!

 

Just to clarify your last statement about "infrastructure to refresh access tokens".

 

Do you mean that unless an access token is refreshed before expiry, the webhooks are not going to fire? I was planning on only refreshing when a webhook is received in order to get more data.

Reply
0 Upvotes
HubSpot Moderator

Hi, @lc_dan.

 

Thanks for bringing this up — I should have been clearer.

 

Webhook notifications will continue to fire as long as your app is connected. You do not need up-to-date access tokens to receive these requests. Thus, if your app passively listens for notifications, you could complete the OAuth flow once and never refresh your access tokens.

 

If you wish to request or manipulate any data, however, you will need to refresh access tokens.

Isaac Takushi

HubSpot Developer Support
Reply
0 Upvotes