HAPI Key Security

As it stands the HubSpot API will accept the HAPI Key for all requests.

 

As a corollary this means that anyone who has the HAPI Key can do anything with the account. Such as:

 

  • Export all contact information
  • Send any email campaign
  • Manage users
  • Export and manage deals
  • Etc.

There is no way to limit the power of the HAPI Key in HubSpot which is really a weak point. If the key is ever compromised, the portal is at extreme risk which can do irreparable damage to a company/brand.

 

What is needed is a more comprehensive security setup for HAPI keys. Yes, we can phase them out and move to OAuth, but seriously, the HAPI Key is used in so many integrations by now that it would be literally impossible to "phase out" at this point.

 

So, for the long run I am proposing:

 

  • Create a way to maintain multiple keys and suspend/revoke their access
  • Make it possible to limit them by IP
  • Add an optional hashing mechanism for [sensitive] calls
  • Add a way to fine tune any key's access to different APIs.

As an example, look at SparkPost's API key management:

 

Edit_API_Key___SparkPost-2.jpgAPI_Keys___SparkPost.jpg

 

I would also like to add that the key itself looks like a UUID v4 — not guaranteed to be cryptographically secure.

 

I think you would be better off using other recommended hashing methods to generate guaranteed unique and unguessable keys at least 128bits long. Just my own two cents.

HubSpot updates
9 Replies
MarkdeLange
Regular Contributor

Great idea, I agree the happykey is a weak spot from a security point of view. 

 

Another use case is where on a global account individual users may need to be restricted to accessing data via the happykey  to assets based on HS teams/brands. 

 

 

hannuCR
Occasional Contributor

Yes, this is definitely a necessary feature, please implement this.

gillytech
Regular Contributor

SECURITY ADVISORY

As a supporting argument for better API security, and to deter unsuspecting HubSpot users from compromising the security of their accounts, I'd like to point something out.

I was on a site called emaillistverify.com. The site offers email verification services which isn't a bad thing. However, they offer a HubSpot "integration" which asks for your hapikey in order to connect. HubSpot offers a standard OAuth authentication structure for legitimate apps. You should NEVER give out your hapikey to any other company or individual on the internet. With this key anyone can do almost anything to your account with reckless abandon.

emaillistverify.jpg

To the HubSpot engineers, please help us secure our HubSpot accounts! There needs to be granular access controls and multiple key management.

RiccardoPisani
Esteemed Contributor

+ 1 definitely needed - It is imo one of the most important things for a big company and a more structured HS account like the one we have. 

Hani-RT
Regular Visitor

Does this feature request also take into consideration the issue mentioned here? https://community.hubspot.com/t5/HubSpot-Ideas/Allow-more-than-one-active-API-key-at-a-time/idi-p/31...

gillytech
Regular Contributor

@Hani-RT Yes, I believe this implementation would cover the feature request you linked to, but in a slightly different way. With a more robust API key auth system such as what I mention above, you would be able to keep one key alive while you roll out a new key in parallel. When you're sure the old key is no longer being used (request logging per key would be good for making sure of that) then it could be deactivated.

 

HubSpot engineers: Please take note of this, there will be a breach sooner or later with your current (risky) hapikey setup and you want to have all bases covered before it happens. In the info security world, nothing happening ever is a good thing!

Hani-RT
Regular Visitor

Thanks for the reply, @gillytech!  That's fantastic.  Smiley Happy

gbe
New Contributor

This is very important for us, as GDRP compliance rely on building a 'registry of treatement' + 'inform in case of sensitive data breach'.

In this registry, we have to indicate who is allowed to export which subset of information.

Today, this means that each integration is allowed to export any sensitive data.

 

Even worse, we have no way to identify if any of them did export sensitive data, while there are legal delay to publicly disclose security breaches.

alvinlzg
Occasional Contributor

This is a good idea. I am relatively new to HubSpot but we do use the API Keys for integration. OAuth seems to be a safer approach, but it also requires more effort. Some of the things we hope HubSpot would do is to allow the Admin account to have multiple keys instead of one account = one key and then share this key to other parties. It makes things worse when these keys allow the 3rd party to do everything.

 

Next thing you know, your API Key is too old and you're supposed to rotate them. So, who did I pass those keys to? Maybe I should rotate and see who comes back shouting at me? Smiley Happy