What is it?

The new Developer Secrets API (beta) allows agents and custom automation to manage your app’s secrets end to end. An agent can list your app’s secret keys, create new secrets, update existing values (for example, to rotate an expiring credential), and delete secrets that are no longer needed.

Why does it matter?

Setting up and maintaining the secrets an app depends on, like API keys and access tokens, has traditionally been a manual step done through the HubSpot CLI or developer tools.

With the Developer Secrets API, agents can manage these credentials for you. Secret values are write-only, meaning the API never returns them, so agents can create, update, and delete your credentials without ever being able to read their values.

How does it work?

The API is scoped to your app, using the HubSpot account tied to your authentication token. Each account can have up to 100 app secrets across all of its apps.

Authorize your app with developer.secrets.read to list secret keys, and developer.secrets.write to create, update, or delete them. If your agent needs to check what’s missing before creating a secret, authorize both scopes.

To access the beta endpoints, use your developer api key to authenticate (https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/overview#developer-api-keys)

Then call the endpoints under /developers/secrets/2027-03-beta/apps/{appId}/secrets:

• GET .../secrets: list secret keys
• POST .../secrets: create a secret
• POST .../secrets/update: update a secret’s value
• POST .../secrets/delete: delete a secret

Who gets it?

Currently in beta, available to all HubSpot accounts with developer apps.