# HubSpot

Connect Foundry to HubSpot to import data and create, modify, and delete records in HubSpot.

## Setup

1. Open the [Data Connection](../../data-connection/overview/index.md) application and select **+ New Source** in the upper right corner of the screen.
2. Select **HubSpot** from the available connector types.
3. Follow the additional configuration prompts to continue the setup of your connector using the information in the sections below.

Learn more about [setting up a connector](../../data-connection/set-up-source/index.md) in Foundry.

### Authentication

The HubSpot source authenticates with a private app access token.

Create a private app in your HubSpot account and copy its access token. For the current steps, review the [HubSpot private app documentation ↗](https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview).

The private app must meet the following requirements for this connector to work:

* You must be a HubSpot super admin to create a private app.
* The scopes granted to the private app determine which tables the connector can explore and sync. Grant read or write access for every scope you intend to use from Foundry.

:::callout{theme="warning"}
A private app with insufficient scopes still authenticates successfully. The source connects without an error and silently omits every table the token cannot reach, so tables missing from exploration usually indicate missing scopes rather than a connection problem. Two later changes in HubSpot produce the same result: a private app loses scopes when the HubSpot account subscription is downgraded, and rotating the access token with the **Rotate and expire later** option expires the previous token seven days afterward.
:::

### Networking

The table below lists the domains that the source must access to run.

For [Foundry worker](../../data-connection/core-concepts/index.md#foundry-worker) connections, add an [egress policy](../../administration/configure-egress/index.md) for each domain.

If the domains are on another network and you use [agent proxy egress policies](../../administration/configure-egress/index.md#agent-proxy-egress-policies) (preferred) or an [agent worker](../../data-connection/core-concepts/index.md#agent-worker) (not recommended), the agent must be able to reach them. The systems on those domains must also allow connections from the agent. [Learn more about agent networking.](../../data-connection/set-up-agent/index.md#configure-agent-network-access)

| Domain | Required |
|--- |--- |
| `api.hubapi.com` | Always |

### Connection details

| Option | Required? | Description |
| --- | --- | --- |
| `Private app token` | Yes | The access token copied from the private app in HubSpot. |

## Migration

HubSpot stopped allowing new API keys to be created on July 15, 2022 and sunset API key authentication on November 30, 2022. Review the [HubSpot API key sunset changelog ↗](https://developers.hubspot.com/changelog/upcoming-api-key-sunset) for details. Existing sources that use an API key must be migrated to a private app access token.

1. Create a private app in HubSpot and copy its access token, as described in [Authentication](#authentication).
2. In **Connection settings > Connection details**, select **Private app** as the credentials method and enter the access token.