Webhook without OAuth flow

[lc_dan]

I am developing an in-house app for Hubspot, so I use the API key approach instead of the OAuth one.

Is this possible to subscribe and receive webhooks without going through the OAuth flow?

The following (from Webhooks API Overview) seems to imply that OAuth is required:

"Webhooks are set up for a HubSpot app, not individual portals. Any portals that install your app (by going through the OAuth flow) will be subscribed to any webhook subscriptions set up for the app."

Can anyone confirm?

[IsaacTakushi · Accepted solution]

Welcome, @lc_dan.

I can confirm that only OAuth apps can leverage webhook subscriptions.

Once you create your app , however, you will only need to go through the OAuth flow once to connect the integration, provided you have infrastructure to refresh access tokens every six hours.

Plenty of customers use OAuth apps for their in-house integrations.

[lc_dan]

Thanks!

Just to clarify your last statement about "infrastructure to refresh access tokens".

Do you mean that unless an access token is refreshed before expiry, the webhooks are not going to fire? I was planning on only refreshing when a webhook is received in order to get more data.

[IsaacTakushi]

Hi, @lc_dan.

Thanks for bringing this up — I should have been clearer.

Webhook notifications will continue to fire as long as your app is connected. You do not need up-to-date access tokens to receive these requests. Thus, if your app passively listens for notifications, you could complete the OAuth flow once and never refresh your access tokens.

If you wish to request or manipulate any data, however, you will need to refresh access tokens.