HubSpot’s cutoff for creating new legacy private apps has now reached existing customer accounts, closing a familiar account UI path for internal API credentials.
HubSpot said in its Developer Changelog that accounts created before September 28, 2026 could create legacy, non-Projects private apps only until October 26, 2026. Accounts created on or after September 28 lost that option on September 28.
The cutoff is part of a bigger developer platform shift
HubSpot announced a wider set of developer platform deadlines during its Fall Spotlight cycle. The company said API versions using /v1/, /v2/ and /v3/ paths, plus legacy public apps and legacy private apps, are moving toward a September 2027 enforcement date. HubSpot also says support for v4 APIs ends on a separate timeline, March 30, 2027.
Some endpoints and features have earlier shutdown dates. Classic CRM cards stop rendering on October 31, 2026, and Pipelines API v1 endpoints stop responding after December 4, 2026.
That makes the private app creation cutoff an early operational milestone, not the final migration deadline. The old creation button is gone for existing accounts, while many existing integrations still have to be reviewed for app architecture, authentication method and API version usage.
HubSpot’s guidance also separates app architecture from API versioning. An app that has moved to Projects can still be at risk if it continues calling legacy API versions, and an app that uses date-based APIs can still be at risk if it remains on legacy app architecture.
Service Keys are HubSpot’s preferred path for simple internal integrations
For new in-account API integrations, HubSpot points users to Service Keys. HubSpot describes Service Keys as scoped credentials for system-to-system integrations, including BI tools, data warehouses, internal automation and reporting workflows.
Service Keys are not a full replacement for every private app use case. HubSpot’s documentation says they can be used for REST API requests, with object-specific scopes, request logs and rotation controls. The same documentation says Service Keys cannot authenticate webhooks, make calls within UI extensions or use other developer platform functionality beyond REST API requests.
For integrations that need webhooks or broader app features, HubSpot directs developers to create a Projects-based app instead. HubSpot’s Fall 2026 developer rollup lists Projects version 2026.09 as generally available and labels Service Keys as public beta, so production-critical migrations should verify feature status and fit inside the account before a legacy setup is retired.
The practical risk is recreation, not only migration
HubSpot says existing legacy private apps continue to work as-is. A team that only checks whether current integrations are still running may conclude nothing has changed. The harder problem appears later, when a cloned setup, sandbox rebuild or replacement integration requires a new private app and the former creation path is gone. Rotating the token of an existing private app is a separate operation that remains available.
That can matter for agencies, RevOps teams and developers that use legacy private apps across internal tools, reporting jobs, custom middleware or sandbox-like rebuilds. In HubSpot’s developer community, one discussion raised the concern that sandbox refreshes or recreated setups could be affected before teams finish moving from legacy private apps. HubSpot staff in that thread reiterated that legacy private apps remain supported until September 2027, while the October 26 creation cutoff still stands.
Dates teams using HubSpot should track
Date
Milestone
September 28, 2026
Creation of legacy private apps disabled for HubSpot accounts created on or after this date.
October 26, 2026
Creation of legacy private apps disabled for accounts created before September 28, 2026.
March 30, 2027
HubSpot says v4 API support ends on a separate timeline.
September 2027
HubSpot’s announced enforcement period for unsupported v1-v3 APIs, legacy public apps and legacy private apps.
What administrators and developers should check next
The safest first step is an inventory. Each legacy private app should be mapped to the workflow, vendor, script or reporting job that depends on it, along with its scopes, owner, token rotation history and API endpoints.
From there, teams can split the work into three tracks:
Authentication: identify which legacy private apps can be replaced with Service Keys and which need a Projects-based app.
Feature usage: flag integrations that rely on webhooks, UI extensions, app cards, workflow actions or other app platform features.
API versioning: look for calls to /v1/, /v2/, /v3/ or /v4/ endpoints and compare them with HubSpot’s date-based API migration guidance.
For small internal scripts, the work may be as straightforward as creating a scoped Service Key and updating credential storage. For more complex integrations, the app architecture and API version migration may need to be planned together, especially when multiple portals, vendors or customer accounts are involved.
For any business relying on HubSpot-connected scripts or internal automations, the migration plan now needs to cover both what is already running and what may need to be rebuilt before September 2027.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
