How to Use HubSpot Secret API in 2026 – Updated Guide

If you’re diving deep into HubSpot API ecosystem, you’ve probably come across the concept of HubSpot Secret API.

But what exactly is it, how do you create it, and how can you securely use it to connect your apps and workflows?

In this guide, we’ll walk you through how to use HubSpot Secret API, how to create a HubSpot secret under a secret name, and how to generate and use the secret API key — all in an easy-to-follow way.

Lets get started.

What Is a HubSpot Secret API?

In simple words, a HubSpot Secret API is a secure way to store sensitive information like API keys, tokens, and private credentials inside your HubSpot account.

Instead of hardcoding credentials into your app or workflow (which is risky), you save them safely using HubSpot Secrets Management feature and then reference them securely in custom coded actions, custom apps, or integrations.

This approach boosts security, keeps your environment clean, and protects your sensitive data from leaking.

How to Create a HubSpot Secret API in Secret Name

The first step is creating a HubSpot Secret API in a secret name.

Heres how you can do it inside your HubSpot Developer Account:

Login to HubSpot Developer Account

Go to your HubSpot Developer Account.

Create or Select Your App

Either create a new private app or open an existing one.

Go to “Secrets” Tab

Inside your app settings, find the “Secrets” section.

Click “Create Secret”

Add a Secret Name (this is the reference name you’ll use inside your code) and the Secret Value (your actual API key, token, or credential).

Save the Secret

Once saved, the secret is encrypted and stored securely.

Important Tip:
Choose a meaningful secret name, like my_private_api_key, to make your code easier to read and manage.

<h2 “2”>How To Use HubSpot Secret API Key

Once you’ve created a secret, the next step is how to use HubSpot secret API key inside your custom code.

Heres a basic example if you’re using it in a Custom Coded Action inside a HubSpot workflow:

// Fetch secret value
const mySecretApiKey = secrets.my_private_api_key;

// Use the secret to call an external API
const url = `https://api.example.com/data`;
const headers = {
“Authorization”: `Bearer ${mySecretApiKey}`,
“Content-Type”: “application/json”
};

const response = await fetch(url, {
method: ‘GET’,
headers: headers,
});

const data = await response.json();
console.log(data);

Whats happening here?

• secrets.my_private_api_key dynamically fetches the actual API key.

• Its never exposed inside your source code.

• If you ever rotate the key, no need to change your code — just update the secret value inside HubSpot.

Thats how to use HubSpot secret API key correctly!

How To Use HubSpot Secret API to Generate Access or Tokens

You can also use HubSpot Secret API to generate dynamic tokens, temporary access credentials, or session-based authentication.

Example Scenario

Imagine you have a secret client ID and client secret stored in HubSpot.

You want to generate an OAuth token at runtime without hardcoding anything.

Heres a quick sample:

const clientId = secrets.my_client_id;
const clientSecret = secrets.my_client_secret;

const tokenUrl = `https://api.example.com/oauth/token`;

const response = await fetch(tokenUrl, {
method: ‘POST’,
headers: {
‘Content-Type’: ‘application/x-www-form-urlencoded’
},
body: `grant_type=client_credentials&client_id=${clientId}&client_secret=${clientSecret}`
});

const tokenData = await response.json();
const accessToken = tokenData.access_token;
console.log(“Generated Access Token:”, accessToken);

This is exactly how to use HubSpot secret API to generate real-time secure access tokens for third-party APIs.

Why Use HubSpot Secret API Instead of Hardcoding?

Its important to understand why you should use it:

Enhanced Security

Secrets are encrypted and never exposed directly.

Easier Maintenance

Update your credentials without changing the app code.

Compliance

Helps meet security best practices and industry compliance standards.

Cleaner code

No cluttering your code with sensitive keys and tokens.

Now lets roll up our sleeves and go step-by-step!

Best Practices for Using HubSpot Secret API

If you want to build secure and scalable apps, follow these tips:

Name Secrets Wisely

Keep names descriptive but avoid exposing sensitive hints (like payment_gateway_key instead of stripe_secret_key).

Limit Scope

Only store whats necessary. Don’t overload secrets with unnecessary data.

Rotate Secrets Regularly

Update your API keys or secrets periodically and just update their value inside HubSpot.

Use in Server-side Code

Avoid exposing secrets in client-side JavaScript that can be seen in browser DevTools.

Audit and Review

Regularly review secrets stored to make sure they are still needed and properly used.

Creating HubSpot Secret API in Secret Name – Wrapping Up

By now, you should have a solid understanding of how to use HubSpot secret API, from creating a HubSpot secret API in a secret name, to using the secret API key, to generating secure tokens.

HubSpot secrets management is a powerful feature that helps you build safer, cleaner, and more scalable applications.

If you’re working with sensitive APIs, theres no better way than leveraging secrets the smart way inside HubSpot.

Common Questions About Using HubSpot Secret API

Can I access secrets in client-side forms or public pages?

No. Secrets are only accessible inside custom code actions, private apps, and server-side environments. They’re not exposed to browsers.

How many secrets can I create inside HubSpot?

HubSpot doesn’t publicly specify a hard limit, but its good practice to keep your secrets organized and delete unused ones.

Can I update a secret without downtime?

Yes. Updating a secret inside HubSpot immediately applies to all workflows or apps using it — no need to redeploy code.

Where can I see the list of all my secrets?

Inside the Developer Portal, under each private app or custom app settings, you’ll find the full list.

Relevant Guides & Services

Where Do i Find the Unsubscribed List in HubSpot

WordPress to HubSpot Migration

Kajabi HubSpot Integration

Pendo HubSpot Integration

Acumatica HubSpot Integration

HubSpot BigCommerce Integration

HubSpot Salesforce Integration