HubSpot is permanently removing the ability to create new legacy private apps from the account settings. It takes effect September 28, 2026 for accounts created on or after that date, and October 26, 2026 for older accounts, which is nearly every established Canadian business. Existing private apps keep working. Nothing you have already built breaks. What changes is how you stand up the next integration: new in-account, system-to-system connections should use Service Keys, and anything that relies on webhooks needs a project-based app instead.
This is a quiet change with a loud potential to trip up a growing business. It is not the dramatic outage the words "deprecation" and "sunset" suggest, and treating it that way wastes energy. The real cost lands on the day you go to connect a new tool and find the familiar path gone, then reach for the wrong replacement. This guide separates what moved from what did not, and gives you a plan you can run before your date.
01. The Quick Answer
- What is being removed: the ability to create new legacy, non-Project based private apps in the HubSpot account UI.
- When: September 28, 2026 for accounts created on or after that date, October 26, 2026 for accounts created before it.
- What still works: every existing legacy private app, unchanged. This is not a shutdown of running integrations.
- What to use instead: Service Keys for account-level data integrations, and a project-based app for webhooks or a full app.
02. What HubSpot Actually Announced
On August 27, 2026, HubSpot posted to its developer changelog that it is permanently removing the option to create new legacy, non-Project based private apps through the account UI. Private apps are the tokens a lot of Canadian SMBs use to connect HubSpot to the rest of their stack: an ERP sync, a Shopify order feed, a nightly data push to a warehouse, a custom script someone wrote two years ago.
HubSpot points to two modern replacements. Service Keys, available through Developer Platform Projects version 2026.09 or later, handle account-level system-to-system integrations. The Developer Platform Projects framework handles full apps and anything that needs webhooks. The legacy private app, which for years was the fastest way to get an access token, is the piece being closed off to new creation.
What most people get wrong:
Many admins remember HubSpot retiring API keys a few years ago and assume this is the same event, that their live integrations are about to stop. They are not. This announcement removes new creation only. The mistake that actually costs money is subtler: assuming Service Keys are a drop-in replacement for every private app, when they cannot do one important thing.
03. The Two Dates That Matter
The practical takeaway for Canadian businesses: if your HubSpot portal was set up before this announcement, and it almost certainly was, October 26, 2026 is your deadline to create any last legacy private app you might want, and the right moment to plan your move to the modern credentials.
04. What Is Not Changing, and Why the Panic Is Misplaced
HubSpot is explicit that all existing legacy private apps continue to work as-is. Your ERP connection keeps syncing. Your Shopify order feed keeps flowing. The token in that custom script keeps authenticating. The change removes a button, not a running service.
So why treat it as urgent at all? Because the day you need a new connection is the day the gap appears, and that day rarely arrives on a calm afternoon. It arrives when you are launching a new store, onboarding a new tool, or fixing a broken sync under pressure. Discovering then that the old path is gone, and that the obvious replacement will not carry webhooks, turns a one-hour task into a multi-day detour. Preparing now converts a future emergency into a routine decision.
There is a second, quieter reason to act. Legacy private apps are owned by the individual who created them. When that person leaves, the app and its token become orphaned, still running but unmanaged. This is the same access and ownership problem we see stall integration projects across accounts, and the migration is a natural moment to clean it up. Service Keys are account-level, with admin-only visibility, which removes that single point of failure.
05. Service Keys vs Project Apps: Picking the Right Replacement
HubSpot now gives you two modern credentials, and the choice between them is the whole game. Match the tool to the job:
| Use case | Right credential |
|---|---|
| Account-level data sync, no webhooks | Service Key |
| Integration that receives HubSpot webhooks | Project-based app (HubSpot CLI) |
| A full app, possibly for the marketplace | Developer Platform Projects app |
| An existing legacy private app already running | Leave it, no action required |
Service Keys are built for the RevOps admin, not only the developer. You create one at Settings, then Integrations, then Service Keys, without scaffolding a whole app to get a token. They bring scoped access so an integration gets only the permissions it needs, built-in activity logging for audit trails, easy rotation with a 7-day grace period, and admin-only key visibility. For the majority of SMB data integrations, this is a cleaner and safer credential than the private app it replaces.
If you are already thinking about how HubSpot connects to the rest of your systems, our guide to HubSpot integrations and automations for B2B covers the wider picture, and the Operations Hub and Data Hub article explains where native sync ends and custom credentials begin.
06. The Webhook Trap Most Teams Miss
Here is the single most important line in the entire announcement: Service Keys do not support webhooks. If your integration depends on HubSpot pushing real-time events, a deal stage change firing an update to your ERP, a new contact triggering a Shopify action, a form submission syncing instantly to another system, a Service Key cannot power it.
That is where a rushed migration goes wrong. A team hears "private apps are going away, use Service Keys," rebuilds a webhook integration on a Service Key, and it silently fails to receive events. For webhook-based integrations you need a project-based app created with the HubSpot CLI, or you keep an existing legacy private app running. This is exactly why the inventory step below matters: you have to know which of your integrations listen for events before you choose a credential.
Why it matters: real-time sync is usually the integration a business can least afford to break, because it is the one keeping the CRM and the commerce or ERP system in agreement. Picking the wrong credential here does not throw an obvious error. It just quietly stops the updates.
07. The Migration Checklist Before the Deadline
| Step | What to do |
|---|---|
| Inventory your private apps | List every legacy private app in the portal and what each connects to: ERP, Shopify, accounting, a data warehouse, or a custom script. |
| Flag anything using webhooks | Webhook-dependent integrations cannot move to a Service Key. Mark them now so you do not pick the wrong replacement. |
| Confirm ownership | Legacy private apps are tied to whoever created them. Identify orphaned apps left by former staff before they become an access problem. |
| Choose the replacement per integration | Service Key for straightforward system-to-system data sync, project-based app for webhooks or a full app. Do not default everything to one. |
| Create Service Keys with scoped access | Grant only the permissions each integration needs, and record the key owner and purpose so audit logging and rotation stay meaningful. |
| Document and schedule rotation | Use the 7-day grace period to rotate keys without downtime, and note renewal owners so credentials do not silently expire. |
None of this requires waiting for the deadline. The whole point of acting before October 26 is that a planned migration is a calm afternoon of work, while an unplanned one is a scramble in the middle of a launch.
08. How AtlanticWorks Helps
AtlanticWorks implements and integrates HubSpot for SMBs, manufacturers, and wholesalers across Atlantic Canada, and we treat this sunset as a routine housekeeping pass: inventory the private apps in your portal, flag the webhook-dependent ones, retire orphaned tokens left by former staff, and move each integration to the right modern credential. If HubSpot connects to your ERP, your Shopify store, or your accounting system, this is also a good moment to confirm those syncs are healthy. When custom logic and AI are in the mix, our work on custom HubSpot AI automation and HubSpot MCP and AI connectors runs on the same modern authentication this change is pushing everyone toward.
09. Key Takeaways
- HubSpot is removing new legacy private app creation, not shutting down existing ones.
- Your date is September 28, 2026 for new accounts and October 26, 2026 for accounts created before then.
- Existing private apps keep working, so there is no outage to fear, only a decision to prepare for.
- Use Service Keys for account-level data sync and a project-based app for anything using webhooks.
- Service Keys do not support webhooks, which is the trap that turns a migration into a rebuild.
- Inventory apps, flag webhooks, fix ownership, and choose credentials before the deadline, not during a launch.
10. Frequently Asked Questions
Are HubSpot private apps going away?
Not the ones you already have. On August 27, 2026 HubSpot announced it is permanently removing the ability to create new legacy, non-Project based private apps through the account UI. All existing legacy private apps continue to work as-is. The change only removes the ability to create new ones, and it takes effect on September 28, 2026 for accounts created on or after that date and October 26, 2026 for accounts created before it.
Will my existing HubSpot integrations break on September 28, 2026?
No. Integrations authenticated by legacy private apps you have already created keep running. The deadline only stops you from creating a brand new legacy private app through the account settings. The risk is forward-looking: the next time you need to stand up a new in-account integration, the old option will not be there, so you need to know which modern credential to use instead.
What is the difference between the September 28 and October 26, 2026 dates?
The sunset is tiered by account age. HubSpot accounts created on or after September 28, 2026 lose legacy private app creation on September 28, 2026. Accounts created before September 28, 2026, which is almost every established Canadian business, lose it on October 26, 2026. If your portal predates the announcement, October 26 is your date.
What are HubSpot Service Keys?
Service Keys are HubSpot's modern authentication method for account-level, system-to-system integrations, available via Developer Platform Projects version 2026.09 or later. You create one at Settings, then Integrations, then Service Keys. They provide scoped access so an integration only gets the permissions it needs, built-in activity logging for audit trails, easy key rotation with a 7-day grace period for safe credential rollover, and admin-only key visibility by default. Because they are account-level rather than owned by one person, they do not become orphaned when an employee leaves.
Do HubSpot Service Keys support webhooks?
No. Service Keys do not support webhooks. If your integration relies on HubSpot webhooks to push real-time updates to an ERP, a Shopify store, or another CRM, a Service Key cannot power it. For webhook-based integrations you need a project-based app created with the HubSpot CLI, or you keep an existing legacy private app running. Choosing the wrong credential is the most common way this migration turns into a rebuild.
Do I need a developer to create a HubSpot Service Key?
No. Service Keys were designed for RevOps admins, data engineers, and IT staff who manage integrations, not just developers. You do not need to build a full app or understand the project structure to get a token for a simple system-to-system data integration. That is a deliberate improvement over legacy private apps, where a quick data push often forced someone to scaffold an entire app just to obtain a key.
What should a Canadian SMB do before the deadline?
Inventory every legacy private app in your portal and note what each one connects to. Flag any that rely on webhooks, because those cannot move to a Service Key. Confirm who owns each app, since legacy private apps are tied to the person who created them and go stale when that person leaves. Then decide the replacement per integration: a Service Key for straightforward data sync, or a project-based app for anything using webhooks. Doing this before October 26 keeps the decision in your hands rather than discovering the gap when you try to build the next integration.
Related resources
How HubSpot connects to the rest of your stack
Where native sync ends and custom credentials begin
Modern authentication for AI-driven integrations
When to bring in help for implementation and integration
Not sure which of your HubSpot integrations need to move?
AtlanticWorks audits your HubSpot portal for the private app sunset: which apps to leave alone, which rely on webhooks, and which modern credential each integration should use before your deadline.
Start the Assessment