> ## Documentation Index
> Fetch the complete documentation index at: https://carnot.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# HubSpot Credentials

> Set up a HubSpot access token for CRM contact management

Configure a HubSpot access token to manage CRM contacts from your Jinba Flow workflows.

## Prerequisites

* A HubSpot account with access to the CRM
* Permission to create a service key or a private app in that account

## Creating a HubSpot Access Token

HubSpot issues two kinds of static token that both work here. They produce the same `Bearer` token, so pick whichever your account offers.

<Note>
  **Private apps have moved.** HubSpot reorganised its developer platform and
  private apps now live under **Legacy apps**. Existing private app tokens keep
  working — no sunset has been announced — but new integrations are steered
  towards **service keys**, which are purpose-built for REST API access.
</Note>

### Option A: Service key (recommended)

1. Sign in to HubSpot
2. Navigate to **Development** → **Keys** → **Service keys** (or **Settings** → **Integrations** → **Service Keys**)
3. Click **Create service key** and give it a name (e.g. `Jinba Flow`)
4. Click **Add new scope** and select `crm.objects.contacts.read` and `crm.objects.contacts.write`
5. Click **Create**, then copy the generated token

<Warning>
  Service keys are currently in public beta. They cannot be used for webhooks or
  UI extensions — REST API requests only, which is all these tools need.
</Warning>

### Option B: Legacy private app

1. Sign in to HubSpot
2. Navigate to **Development** → **Legacy apps** (this is where **Integrations → Private Apps** used to be)
3. Create a legacy app of type **Private**, or open an existing one
4. On the **Scopes** tab, select `crm.objects.contacts.read` and `crm.objects.contacts.write`
5. Open the **Auth** tab, click **Show token**, and copy it

## Setting Up in Jinba Flow

1. Go to your workspace settings in Jinba Flow
2. Navigate to the **Secrets** section
3. Click **Add secret** and choose **HUBSPOT\_ACCESS\_TOKEN** as the type
4. Enter a name and paste the token into **access\_token**
5. Click **Save**

The saved secret then appears in the **Access Token** dropdown on any HubSpot step.

## Required Scopes

| Scope                        | Needed for                                                             |
| ---------------------------- | ---------------------------------------------------------------------- |
| `crm.objects.contacts.read`  | `HUBSPOT_GET_CONTACT`, and the lookup half of `HUBSPOT_UPSERT_CONTACT` |
| `crm.objects.contacts.write` | `HUBSPOT_UPSERT_CONTACT`                                               |

A step that fails with `HTTP 401` or `HTTP 403` almost always means one of these scopes is missing rather than the token being wrong.

## Related Docs

* [HubSpot Tools](/en/pages/tools/productivity/hubspot)
* [HubSpot: legacy private apps](https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview)
* [HubSpot: service keys](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/account-service-keys)