Hubspot currently "strongly recommends" that the access token for each private app be rotated once every 6 months. However, this process requires a Hubspot administrator to manually log into the UI to generate a new token, provision that new token to the app, and following tests, to revoke the old token. In general, this requires probably an hour's worth of time, when you factor in the need to redeploy and reverify the software using the private app, before deactivating the old token. Given that we have 6 (and counting) private apps, for which we store/provision the tokens securely, this essentially requires an administrator to waste a full day every six months fulfilling a security requirement. The primary risk factor that necessitates the need for regular rotation is the fact that Hubspot's API utilizes the access tokens as long-lived bearer tokens in and of themselves. Therefore one way to eliminate the need for access token rotation would be to support an alternate method of authentication, either: 1. Support an OAuth 2 Client Credentials flow such that the client secret is transmitted solely in the request for an API access token with a limited lifetime, which is then used to make the actual API requests. This change would reduce the transmission of client secrets over the network to a limited number of tightly-controlled API calls, thereby mitigating the likelihood of compromise such that rotation is unnecessary, or at least not as frequent. 2. Utilize a request signature (a la OAuth 1 or AWS) such that the client secret is never transmitted in any request, and therefore the risk of secret compromise lies entirely with the client, thereby delegating the need for rotation to the client themselves. If neither of these options are going to be implemented, and therefore regular rotation of private app access tokens will continue to be a requirement, then Hubspot should provide APIs such that the rotation of access tokens themselves can be automated by a separate private app, such that an administrator's time need not be required to accomplish the rotation requirement.
...read more