HubSpot private app access tokens and OAuth tokens are server-only credentials. Grant only the CRM scopes the integration needs, call HubSpot from a server or edge proxy, and validate the X-HubSpot-Signature-v3 header on webhooks.
Scoped access to your portal CRM data.
Signs webhook requests and exchanges OAuth codes.
A contact lookup needs crm.objects.contacts.read, not full CRM write access.
Recompute the v3 HMAC over method, URL, body, and timestamp before processing events.
Pass explicit properties to CRM reads so internal fields stay on the server.
Visitors can read or export your contacts and deals.
API keys were sunset. Migrate to private apps with scopes.
Store HUBSPOT_TOKEN in the vault and expose narrow lookup pipelines that return only the contact or deal properties your UI uses.
No. The tracking script and forms embed are public. Private app tokens are the secrets to protect.
Webflow is a purely static and frontend visual builder with no backend server. To call private APIs from Webflow custom code without revealing secrets in the browser inspector, route requests through RealComposer. RealComposer stores your API keys in an AES-256-GCM vault, injects credentials at the edge, and handles CORS headers automatically.
To merge salesforce contacts with hubspot crm one api, use one RealComposer pipeline with parallel steps. Parallel fetch Salesforce Contact and HubSpot CRM contact into one JSON object. Your Frontend / Web app makes one request instead of several sequential upstream calls.
To solve call hubspot api from client side web application, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
To solve stitch hubspot contact with stripe payment history, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
To combine mailchimp audience with hubspot contacts, use one RealComposer pipeline with parallel steps. List membership from Mailchimp and CRM lifecycle stage from HubSpot. Your Frontend / Web app makes one request instead of several sequential upstream calls.
To aggregate zendesk tickets with hubspot deals, use one RealComposer pipeline with parallel steps. Zendesk open tickets and related HubSpot deal stage in one Retool query. Your Retool app makes one request instead of several sequential upstream calls.
The principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
Webhook Signature VerificationWebhook signature verification is validating that an incoming webhook was sent by the expected provider and was not altered. Providers sign each payload with a shared secret, typically using HMAC-SHA256, and your endpoint recomputes the signature and compares it before trusting the event.
OverfetchingOverfetching occurs when an API response delivers more data than the client application requires to render the current screen or view. For example, downloading an entire 50-field user profile object simply to display an avatar and first name wastes bandwidth, memory, and parsing time.