Leaked HubSpot API Key? Rotate It and Audit

A HubSpot key lets whoever holds it act on your HubSpot account through the API. Depending on the scopes granted to the integration, that can mean reading and exporting contacts, companies and deals, changing records, sending email from connected mailboxes, and reading billing or account details. CRM data is some of the most valuable business information a company keeps, and a stolen key can read it quietly. Replace the credential first, then check what was read or changed.

Check your GitHub account for leaked secrets — free

Provider: HubSpot
Severity: High
Impact: Payments and customer data
Checked live by LeakWatch: No

What a HubSpot API key looks like

HubSpot credentials have changed over the years. The value that LeakWatch flags is a UUID: 36 characters in five groups separated by dashes, made of hexadecimal digits, with a 8-4-4-4-12 layout. Masked, the shape looks like this:

XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX   HubSpot key (masked UUID)

A UUID on its own is common and says nothing about its owner. The value is identified by the word hubspot near it, in a variable name, a setting, or a header. HubSpot has been moving integrations away from API keys toward private app access tokens and OAuth, so a UUID-shaped value near the word is most likely an older key or a token from a legacy setup. Check the integration that uses it before you decide how to replace it, because the replacement procedure depends on which kind of credential you have.

How HubSpot API keys get leaked

Integration code. A sync script or a plugin that calls the HubSpot API, with the credential written into the file for convenience.
Environment files. A .env file or a Docker Compose file listing the HubSpot value next to database passwords and other keys.
Shared spreadsheets and automation tools. A value pasted into a workflow or a connector configuration that was then exported or shared.
Front-end code. A form or a tracking script that calls the API from the browser, which ships the value to every visitor.
Logs and support threads. A request log that records the authorization header, pasted into an issue or a chat thread to ask for help with an error.

What to do in the first hour

Find the integration. Work out which app, script or private app the value belongs to. If it is a private app in your HubSpot account, you can see its token from the app’s settings. If it belongs to a script you do not recognize, that is a warning sign in its own right.
Rotate or replace the credential. Follow the steps in the revocation section below. A rotation issues a new token and expires the old one, so the old value stops working. Prepare the new value in your secret store first, so that the integration does not break longer than necessary.
Deploy the new value. Update the application or the integration, restart it if needed, and run one read request and one write request in a test record. Confirm both succeed and that they affect only the test record.
Check the audit log. HubSpot records account activity, and you should open the audit log for the period since the exposure. Look for contact and company exports, bulk edits, deleted records, changes to users or permissions, and new integrations or apps you did not install. Each of those is worth a closer look.
Review connected apps and users. Check which apps are installed and approved for the account, and remove those you do not recognize. Review the list of users, and remove or downgrade accounts that should not have administrative access.
Check email and sequences. If the integration can send email from a connected mailbox or sequence, look at what it sent. Phishing sent from a trusted CRM address is hard for your contacts to spot.
Clean the repository. Remove the value from the code and, if you want the old copy gone from history, rewrite it. See I accidentally pushed an API key to GitHub, and deep scan your whole git history if you want to check past commits for other values.

Not sure what else leaked? Run a free scan.

Revoke it at HubSpot

For a private app, open your HubSpot account settings and go to the Development section, then the legacy apps list, and open the app that owns the token. Its Auth tab shows the access token. Super admin rights are needed to see private apps at all, so ask a super admin if the page is not visible to you. You can rotate the token there, which issues a new one. HubSpot offers an option to expire the old token immediately, which is the right choice after a leak, and a delayed expiry, which gives the integration time to switch over. Deleting the private app permanently revokes its token, so it is the safest choice if nothing still uses the app.

Older keys and tokens from other setups are managed from the place where they were created, which might be an integration in your account or a developer app. If you cannot find the value in any app, search your HubSpot integrations for the name of the tool that used it. The private apps page of your account is the first place to look, and HubSpot’s own documentation covers the current menu names, which change from time to time.

How LeakWatch detects it

The rule is called “HubSpot API Key”. It looks for the word hubspot, in any letter case, optionally preceded or followed by a few letters, digits or punctuation marks, then an assignment separator such as =, : or =>, optional quotes, and then a UUID made of hexadecimal digits in the usual 8-4-4-4-12 groups. The value must end at a quote, a space, a semicolon or the end of the line. A UUID without the word hubspot nearby is not reported, and neither is a UUID that is far from the word. The severity is high, and the impact class is payment data, because the account holds customer and billing information. This type is not checked live: LeakWatch does not send any request to HubSpot with the value it finds.

LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.

FAQ

Can someone see my whole CRM with this key?

It depends on the scopes of the integration that issued the key. A narrow key for a single sync can see only the objects it was given, while a broad key can read and export most of the account. Check the scopes for the integration, and assume the broadest reading until you have looked at the audit log.

Does rotating the key break my integrations?

Only the integration that uses the old value. Put the new value in place before the old one expires, or pick the delayed expiry option so that the switch can happen during a planned window. If the value is clearly being abused, expire it at once and accept a short interruption.

Do I need to tell my customers?

Not unless you can see that customer records were exported, changed or emailed by someone who should not have had access. If that is the case, follow your privacy policy and the notification rules that apply where your customers are, and speak to whoever handles data protection in your company before you write to anyone.