Private apps are going. Here's what to do about it.
Since 26 October you can't create a new private app in an existing HubSpot account. The ones you already have still work, but they go unsupported in September 2027. Most portals I look at have a few, and nobody remembers what half of them do.
What's changed
HubSpot has switched off the option to create legacy private apps. For accounts made on or after 28 September 2026 it went that day; for everyone else it went on 26 October.
Your existing private apps carry on working for now. But HubSpot has also announced that legacy private apps, along with the v1 to v3 APIs, become unsupported in September 2027. Unsupported means no bug fixes and no security updates, and no promise they'll keep working.
The replacement for most of them is something called a Service Key.
Why this matters if you're not a developer
Private apps are the quiet plumbing behind a lot of portals. In practice they tend to be:
- a sync to a data warehouse or a BI tool like Power BI or Tableau
- a script someone wrote to tidy data or push records from another system
- website forms or a product sending data in through the API
- something an agency built for you two years ago
The common thread: they were often set up by one person, and that person may not work for you any more. When one of these stops working, data just stops arriving. Nobody gets an error message. Reports go quiet and people assume sales are slow.
What Service Keys are
A Service Key is a credential for one system to talk to your HubSpot account. You'll find them under Settings › Integrations › Service Keys. Compared with the old private apps:
- Scoped. Each key only gets the permissions you tick, and never more than the person creating it already has.
- Not tied to a person. The integration keeps working if the creator leaves, and admins can still see and manage the key.
- Logged. You can see when a key was last used and what it did.
- Easier to rotate. When you replace a key, the old one keeps working for seven days so nothing breaks mid-swap.
Two catches. Creating one needs Developer Tools access. And Service Keys don't support webhooks. If an integration needs HubSpot to push events out the moment something changes, it needs a Projects-based app instead, which is a proper developer job.
One gotcha if you use sandboxes: you can't create legacy private apps in a new or refreshed sandbox either. If your testing relies on copying an existing private app setup into a sandbox, plan the move to Service Keys before you next refresh.
What to do this month
- List what you've got. Go to Settings › Integrations › Private Apps. Note each app's name, who created it, what permissions it has and when it was last used.
- Find out what each one feeds. Ask around. If nobody knows and it hasn't been used in months, it's a candidate for deletion.
- Delete the dead ones. Every unused app with broad permissions is a token someone could misuse.
- Sort the live ones. No webhooks: move it to a Service Key. Needs webhooks: it needs a Projects-based app, so book developer time.
- Check the code at the same time. The same integrations are usually calling the v3 APIs, which have the same September 2027 deadline. One piece of work, not two. More on that here.
None of this is urgent today. It becomes urgent next summer, when everyone else realises at once and developers are booked up. Doing the list now takes an hour.
Not sure what's connected to your portal? It's one of the things I check in the free health check, along with seven others. Twenty minutes, and you get a score out of 100. Book a free health check.