Dennis and Robert from HubSpot show how to switch from API keys to Private Apps for authentication. They walk through examples in Postman and custom coded actions so you can update your integrations securely.
Hello friends. Dennis here, developer advocate at HubSpot. If you haven't already seen, at the end of November we are sunsetting Support for the HubSpot API key, popularly known as the Hapkey, and it'll be replaced with Private apps. Private apps provide a much secure method of authenticating with your portal, and they are pretty easy to get started using. In this video, Robert Angley, manager on our Solutions Architecture team, gives us a couple examples of how easy the process is. The first example shows you how to use the private app with the popular API platform Postman. And the second example we're going to walk through how to set it up with a custom coded action. I'll leave some useful developer doc links in the description below. And as always, if you like this content, go ahead and do the old like and subscribe. Okay, let's go.
In the coming months, HubSpot is going to be retiring API key as means of authentication for the HubSpot API. This will be replaced with Private Apps. Both of these items are ways to authenticate your API calls. But the benefit of private apps is that for a single portal you can have multiple access tokens that are specifically scoped to only certain behaviors. So they have an inherent layer of increased security. So with an API key you only have one global key for the account and that leads to circumstances where may have a difficult time tracking where an individual call is coming from. If you have multiple apps that are using that key, and if you need to invalidate that key, you invalidate the key everywhere. So wanted to provide a quick overview of what this change really looks like in practice and an example of one or two places that might need to change and how you might change that. This change is talked about in this developer announcement. So as a starting point, we will look at making an API cool API call using the existing method of using an API key. API keys are accessible in your HubSpot portal under settings, under Integrations and API key. When you have the this value available, it is included as a query parameter in a HTP URL. And in Postman I am using an environment variable so you're not seeing the API key, but in the background that value will be swapped out for the current key. I can make a call and I get a response. Now, in the new world of using private apps in HubSpot, we'll go through the change that needs to happen. So first we need to create a private app. I've done that under the Private App section. I'm going to create Private App. I give it a name so that we know where this the source of this API call will be surfaced in other parts of the HubSpot tool. Then we declare certain scopes. I am going to utilize the Just contacts write and read for this particular app and I will create it. Now this token is will be used as a authorization bearer token. I'm going to show this token and copy it and then in the future I'll cancel this and I'm gonna get rid of it since I'm showing everyone on this video what this key is. Remember this is a secret key safe. So I copy it and then over over in my place where I'm making my API calls, I will add an authorization header a bearer token and I'm going to create a new environment variable for this actually. So let's go over to this as an I will paste in my private app token, save that. Now I go back to my call and I'll be able to select that token in the background. This token will be that call and I'll remove the query parameter that has API key. Click send and I get the exact same response now that my call is authorized using this new token. One other place or example of how you might make this change is that if you're using say the HubSpot Node API client, you extend. When you instantiate the client you can pass in your API key and instead of passing an API key you pass in access token in this custom workflow coded action. I'm going to add a new secret here and I'll call this app token. I'll put my value in again and then I would process env private app.
Token.
I would remove my old API key and save and that's all we need to do. We've updated the authentication from our API key to our private app token.
