HubSpot Stopped New Private Apps: Use a Service Key for List Tools

HubSpot no longer lets you create a new legacy private app. If a tool asks you for a "private app access token", create a HubSpot service key instead: open Development > Keys > Service keys, click Create service key, add the scopes the tool lists, and paste the key where the token used to go. Private apps you already have keep working, so there's nothing to fix for connections made before the cut-off.

An r/gtmengineering post last month put it bluntly: HubSpot is killing new private apps on 26 October. That's true for new ones only. Below is what HubSpot's own pages say (read 2 November 2026) and what changes for list tools such as verifiers, enrichment apps and sync scripts.

What changed, and when

From HubSpot's developer changelog, Legacy Private App Creation Being Disabled (announced 27 August 2026):

Date	What happens
28 September 2026	Accounts created on or after this date can't create legacy private apps
26 October 2026	Accounts created before 28 September 2026 can't create them either
September 2027	Legacy private apps and the v1 to v3 APIs become unsupported (changelog of 15 Sep 2026)

Two quotes matter most. On existing apps: "All existing legacy private apps continue to work as-is." On what unsupported means: "HubSpot will no longer release bug fixes, reliability improvements, or security updates for these versions." It doesn't say requests will be refused.

Create a service key, step by step

From HubSpot's service key guide:

1. In HubSpot, open Development in the left sidebar, then Keys > Service keys. The changelog also lists the path Settings > Integrations > Service Keys.
2. Click Create service key and give it a name that says which tool uses it.
3. Click Add new scope, pick the scopes the tool documents, and click Update.
4. Click Create and confirm. Copy the key.
5. Paste it into the tool and run a small test.

Who can do this: super admins and users with the Developer tools access permission. A key can only get scopes its creator already has, so a marketing user without contact write access can't create a key that writes contacts.

What's different from a private app token

	Legacy private app	Service key
Create new ones	No, since 26 Oct 2026	Yes
Sent as	Bearer token	Bearer token (example starts pat-na1-)
Scopes	Picked per app	Picked per key, limited to the creator's own access
Rate limits	100 per 10 s (Free, Starter), 190 (Pro, Enterprise)	Same limits as privately distributed apps
Rotation	Manual	Rotate now, rotate later (old key works 7 more days) or automatic every 3, 6 or 12 months
Webhooks, UI extensions	Yes	No: use a project-based app

Rate limits come from HubSpot's usage guidelines. One limit to watch: HubSpot caps an account at a combined 100 project-based apps, service keys and MCP connectors.

What this means for list tools

Most tools that read a HubSpot list, check it and write a result back only make REST calls. A service key covers that. Before you create one:

• Copy the scopes from the tool's docs. Don't tick everything. For example, our HubSpot integration needs crm.lists.read and crm.objects.contacts.read to read a list, plus crm.objects.contacts.write, crm.schemas.contacts.read and crm.schemas.contacts.write to create and set the sv_status property.
• Turn on automatic rotation only if someone will paste the new key. When the old key expires, the tool's calls fail with a 401. Note the rotation date in the same place you track renewals.
• Use one key per tool. If a vendor is compromised or you stop using it, you can revoke one key without breaking the rest.
• If the tool needs webhooks (for example, real-time sync on contact create), a service key won't do. The vendor needs a project-based or public app.

If you only need verification on new contacts, there's a route that needs no HubSpot key at all: a workflow's Send a webhook action calls the verifier and writes the answer back. See verifying new HubSpot contacts with a workflow.

Plan for September 2027

If an integration still runs on a legacy private app, put a date in the calendar for the first half of 2027:

1. List every legacy private app in the account (in your HubSpot settings, under integrations) and what uses each one.
2. Delete the ones nothing uses.
3. For each one left, create a service key with the same scopes, swap it in, test, then delete the private app.
4. Ask vendors whose code calls v1 to v3 endpoints what their plan is. HubSpot's changelog moves those versions to unsupported at the same time.

Where SimpleVerifier fits

The HubSpot integration takes a service key, or a private app token you already have. Pick a list or segment on Integrations and each contact gets valid, risky or invalid in sv_status. Our walkthrough on tagging HubSpot contacts with sv_status covers the rest. For a one-off clean, export and check the file instead: see cleaning HubSpot contacts. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.