Where do I create a private app in HubSpot?

Sign in to HubSpot as a super admin, open Settings, then Integrations, then Private Apps. Click Create a private app. The token is shown once after creation.

Which scopes do I need to grant?

Four read-only scopes: read deals, read deal schema (which covers pipelines and stages), read owners, and read companies. Callmine never needs write scopes.

How does Callmine store the token?

The token is encrypted at rest with a symmetric key held in Google Secret Manager. Only the analysis worker decrypts it at request time. A read of the database alone does not expose the token.

Can I rotate the token later?

Yes. Generate a fresh token in HubSpot, paste it into the same Callmine card. The new credential overwrites the old one. Existing reports, schedules, and discovery cache persist across rotations.

How do I connect HubSpot with a private app token?

Integrations / HubSpot·May 31, 2026·1 min·By Callmine Team

Create a HubSpot private app with four read-only scopes, copy the token, paste it into Callmine. Done in under two minutes.

TL;DR

In HubSpot, create a private app with four read-only scopes (deals, deal schema, owners, companies). Copy the generated token. In Callmine, paste it under /settings → Integrations → HubSpot. The integration is live on save.

Steps

01Sign in to HubSpot as a super admin. Open Settings → Integrations → Private Apps. Click Create a private app.
02Name the app something recognizable, like "Callmine — read-only". Skip the logo if you want.
03Open the Scopes tab. Grant exactly four read-only scopes: crm.objects.deals.read, crm.schemas.deals.read, crm.objects.owners.read, and crm.objects.companies.read. Save the app.
04HubSpot shows the generated access token once. Copy it — HubSpot will not display it again.
05In Callmine, open /settings, find the HubSpot card under Integrations, choose Connect with private app token, paste the token, and click Save. Callmine validates the token against HubSpot's API and runs discovery on the portal.

When to use this path

Use a private app token when your HubSpot portal doesn't permit third-party marketplace apps, when your security policy prefers a credential under your team's direct control, or when you want a token that won't silently refresh during an analysis run. For the OAuth path, see How do I connect HubSpot to Callmine via OAuth?.

Rotating or replacing the token

To rotate, generate a new token in the same HubSpot private app and paste it into the Callmine card. The old token can then be revoked in HubSpot once you've confirmed the new one works. Reports, schedules, and the discovery cache survive rotation.