Select spec version:

HubSpot Destination Config Reference

Complete Rudder CLI reference for the HubSpot destination config keys, API versions, custom behavioral events, device mode, and secrets.
Available Plans
  • free
  • growth
  • enterprise

HubSpot is a CRM and marketing destination. RudderStack creates and updates contacts from identify calls and records track events, from its servers or — for web sources — through HubSpot’s own script in device mode.

In a HubSpot destination spec:

  • type: hs
  • definition_version: 1

Sample configuration

yaml
version: rudder/v1
kind: destination
metadata:
  name: hubspot-prod
spec:
  id: hubspot-prod
  display_name: HubSpot Production
  type: hs
  definition_version: 1
  enabled: true
  config:
    api_version: newApi
    access_token: "{{ .HUBSPOT_ACCESS_TOKEN }}"
    hub_id: "{{ .HUBSPOT_HUB_ID }}"
    lookup_field: email
    do_association: false

    hubspot_events:
      - rs_event_name: Order Completed
        hubspot_event_name: pe12345_order_completed
        event_properties:
          - from: revenue
            to: order_value

    connection_mode:
      web: cloud
      cloud: cloud
    consent_management:
      web:
        - provider: oneTrust
          consents:
            - marketing

The above example uses the new API with email as the upsert key, and connects web sources in cloud mode, so it omits event_filtering — see Event filtering.

Config keys

config accepts only the keys listed below. The shared config key rules cover unknown keys, defaults, and immutability.

In cloud mode HubSpot accepts identify and track events. In device mode, web sources also send page.

Connection

api_version

Required

Type: string

Description: HubSpot API that RudderStack writes through.

Notes:

  • newApi — HubSpot’s v3 API. Use this one.
  • legacyApi — HubSpot’s v1 API, which HubSpot has deprecated. It updates contacts only by email.
  • The dashboard defaults this field to newApi. Rudder CLI requires it explicitly.
  • A spec that omits this key fails validation.

access_token

RequiredSecret

Type: string

Description: HubSpot private app access token or service key. Used by both API versions.

Notes:

  • At most 100 characters, and must not contain line breaks.
  • Templates aren’t accepted in place of a literal; a template is measured as text against the same limit.

Supply it as a {{ .VAR }} reference rather than a literal — see Secrets.

See Where can I find the HubSpot access token? for the accepted credential types and acquisition paths.

hub_id

Secret

Type: string

Description: Your HubSpot Hub ID, shown under your account name in HubSpot.

Notes:

  • At most 100 characters, and must not contain line breaks.
  • A {{ path || fallback }} template is accepted in place of a literal.

New API settings

These keys apply when api_version is newApi.

lookup_field

Required

Type: string

Description: HubSpot contact property RudderStack matches on to upsert contacts — for example email. Pass the same property, with the value to match, in the identify event’s traits.

Notes:

  • Required when api_version is newApi. Leave it unset otherwise.
  • At most 100 characters, and must not contain line breaks.
  • A {{ path || fallback }} template is accepted in place of a literal.
Use a property that’s unique in HubSpot. Unique properties enable batch upsert, which is much faster; non-unique ones fall back to a slower search-based flow.

do_association

Type: boolean

Default value: false

Description: Create associations between object records. This is used with Reverse ETL sources.

Notes:

  • Applies when api_version is newApi. Leave it unset otherwise.

hubspot_events

Type: array of objects

Description: Maps RudderStack track events to HubSpot custom behavioral events, with optional property mappings.

Notes:

  • Applies when api_version is newApi. Leave it unset otherwise.
  • rs_event_name — RudderStack event name.
  • hubspot_event_name — internal name of the HubSpot custom behavioral event.
  • event_properties — array of from (RudderStack property) and to (HubSpot property) pairs.
  • Every string is at most 100 characters, or a {{ path || fallback }} template.
yaml
hubspot_events:
  - rs_event_name: Order Completed
    hubspot_event_name: pe12345_order_completed
    event_properties:
      - from: revenue
        to: order_value

See Custom behavioral events.

Event filtering

Client-side event filtering applies only when connection_mode.web is device — the dashboard shows these controls only then, and the SDK is what applies the filter. Rudder CLI accepts the block in any mode, but events sent in cloud mode reach HubSpot unfiltered.

event_filtering

Type: object

Description: Restricts which track events the SDK passes to HubSpot’s script, by event name.

Notes:

  • Applies when connection_mode.web is device. Leave it unset otherwise.
  • whitelist — array of event names to allow; every other track event is dropped.
  • blacklist — array of event names to drop; every other track event is allowed.
  • The two are mutually exclusive, and Rudder CLI enforces it — setting both fails validation.
  • Each name is at most 100 characters, or a {{ path || fallback }} template.
yaml
connection_mode:
  web: device
event_filtering:
  whitelist:
    - Signed Up

Per-source keys

Both keys are objects keyed by the local source type — the tokens listed under Source types. A key naming a source type this destination doesn’t support fails validation.

connection_mode

Type: object

Description: Maps each source type you connect to the mode its events reach HubSpot in, using the modes in Source types.

Notes:

  • An entry is required for each source type you connect — see Connect a source.
  • A mode the source type doesn’t support on this destination fails validation — for example device for android.
yaml
connection_mode:
  web: device
  cloud: cloud

Source types

HubSpot accepts events from these source types in the mentioned connection modes:

Source typeConnection mode
androidcloud
android_kotlincloud
ioscloud
ios_swiftcloud
webcloud, device
unitycloud
cloudcloud
react_nativecloud
fluttercloud
cordovacloud
warehousecloud

Only web offers device mode, which loads HubSpot’s native script in the browser. See HubSpot device mode and RudderStack Connection Modes.

warehouse is the token a Reverse ETL source resolves to. Rudder CLI manages the destination’s warehouse entry — if the destination is connected to a Reverse ETL source, set connection_mode.warehouse: cloud in its spec, or apply removes it.

Rudder CLI can also declare the Reverse ETL connection itself, for the types listed under Supported destinations — see Manage Reverse ETL Connections using Rudder CLI.

The dashboard additionally offers HubSpot to AMP and Shopify sources. Rudder CLI doesn’t manage those connections, so amp and shopify are invalid here.

Connect a source

An event stream connection to this destination is checked against two rules at validate time.

The source’s type must be supported. A source’s type resolves to one of the tokens above before the check — a JavaScript source resolves to web, and webhook and server-side SDK sources resolve to cloud. Every type an event stream source can resolve to is supported here, so this check always passes.

The destination config must carry a connection_mode entry for that source type. This lives on the destination spec, not on the connection spec. Without it:

destination 'hubspot-prod' config has no 'connection_mode' entry for source type 'web'

HubSpot needs no additional config keys to connect a source of any type, in any mode.

Secrets

access_token and hub_id are the secret keys. Write each as a {{ .VAR }} reference and supply the value at apply time:

yaml
config:
  access_token: "{{ .HUBSPOT_ACCESS_TOKEN }}"
  hub_id: "{{ .HUBSPOT_HUB_ID }}"
bash
export RUDDER_HUBSPOT_ACCESS_TOKEN="pat-na1-..."
export RUDDER_HUBSPOT_HUB_ID="12345678"
rudder-cli apply

# or
rudder-cli apply --var-file secrets.vars.yaml

Note that:

  • rudder-cli import writes only the secrets the API returns, as {{ .VAR }} references, and leaves the others out. Add any secret key it leaves out, then supply the variables before you apply — see Secrets.

See How to Use Variable Substitution in Rudder CLI.

Changes by release

VersionChange
v0.29.0Breaking: A null config value, written as key: null, key: ~, or key: with no value, fails validate with '<key>' must not be null; set a value or remove the key. Earlier releases accepted it: a top-level null planned an update on every apply, and a null inside a list item failed at the API.
What to do: Remove the key to leave it unset, or give it a value.
v0.29.0Breaking: An empty string, "", on a key that takes one of a fixed set of values fails validate with '<key>' must be one of [...], unless "" is one of the key’s values. Earlier releases accepted it, and the API rejected it at apply.
What to do: Remove the key to leave it unset, or set one of the listed values.
v0.29.0Changed: validate warns when a secret key holds anything but one {{ .VAR }} reference with no default, and when one variable fills two secret keys. It also masks secret values in the lines it prints.
v0.29.0Changed: rudder-cli import writes each secret reference single-quoted, as '{{ .VAR }}', so a value containing double quotes, like a JSON key file, substitutes as a string. A single quote in a value that fills such a reference is written as ''.
What to do: In a spec imported by an earlier release, quote each reference to a JSON value by hand: '{{ .VAR }}'.
v0.29.0Changed: validate reports a value of the wrong type once per key, such as 'email' must be a string, instead of one raw decoding error.
v0.28.0Added: warehouse source type, for destinations connected to a Reverse ETL source. Set connection_mode.warehouse: cloud for such a destination, or apply removes the entry.

For changes across every destination type, see Destination Type Changes by Release.

See more

Questions? Let's figure it out together.

Join the RudderStack Slack community to connect with other users, customers, and the RudderStack team — or reach out for direct support.