How to get a HubSpot API key has changed: HubSpot no longer issues the old account-wide key, and new private apps can no longer be created. What you create now is a service key. In HubSpot, open Development, then Keys and Service keys, create a key, add the scopes it needs and copy it. You send it as a Bearer token.
The steps above come from HubSpot's service keys documentation and its scopes reference, with the day we last checked them.
Pick only the scopes you need
Scopes are picked per object, with read and write chosen separately. A sync that only reads contacts needs the contacts read scope and nothing else, and imports take a scope of their own.
A key can only get scopes its creator already has, so a teammate with narrow access makes a narrow key. Super admins and users with the Developer tools access permission can create keys; anyone else asks one of them. Custom object scopes need an Enterprise account.
Name each key after the job it does, not the person who made it, so you can still tell later what it was for.
If the menu does not match
Service keys were still in public beta when we checked, so menu names may move. HubSpot's changelog also lists the page under Settings, Integrations, Service Keys, so try that path before you assume you lack access.
If you already run a legacy private app, keep its token. It sits under Development, Legacy apps, the app, then its Auth tab.
What to do next
Store the key in a password manager, then test it with one read:
If it fails, compare the key's scopes with the object you asked for. Every call from there counts against HubSpot API limits by plan and app type.
To connect HubSpot to Oneprofile you need no key: sign in to HubSpot from Oneprofile once and access stays current on its own. It is also the only way to get HubSpot's changes as they happen, because HubSpot sends live changes only to an app the account installed.