In HubSpot, navigate to Settings > Integrations > Private Apps and create a new private app, selecting the required scopes
Copy the generated access token shown after creation — it is only fully visible once
In all API requests, include the header Authorization with value Bearer YOUR_TOKEN
There is no refresh step — private app tokens do not expire unless manually rotated or the app is deleted
To rotate the token, go back to the private app settings in HubSpot and generate a new token, then update all callers
Known gotchas
HubSpot deprecated hapikey query-parameter API keys in 2022 — existing integrations using hapikey will eventually stop working and must be migrated
Private app tokens inherit only the scopes selected at creation time; adding scopes later requires generating a new token (the old one's scopes do not update)
Do not use OAuth app tokens as drop-in replacements for private app tokens — they have different expiration and refresh semantics
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp