HubSpot API review
Best free CRM endpoint
POST /crm/objects/2026-03/contacts/batch/upsert Authorization: Bearer $HUBSPOT_PRIVATE_APP_TOKEN # 0 credits → CRM writes are not metered # 100 calls per 10s on Free and Starter # 250,000 calls a day, shared across every app
The HubSpot API is the one record in this directory where the interesting number is not a price. CRM reads and writes are not metered, the free tier includes API access rather than just the web app, and a pipeline that creates ten thousand contacts a month pays the same as one that creates ten.
What you are buying is throughput. Every call counts against two windows, and both are set by the product tier of the account the app is installed in: 100 requests per 10 seconds on Free and Starter, 190 on Professional and Enterprise, with a daily ceiling of 250,000, 625,000 and 1,000,000 respectively. The burst window is per app. The daily one is shared across every app in the account, which is the part that catches teams out.
That makes HubSpot the cheapest place in this directory to land the rows you just paid somebody else to find, and the HubSpot CRM API itself is wide: objects, associations, properties, custom objects, workflows, forms, events and transactional email, all over REST, plus two official MCP servers.
One thing to be clear about before you start. A HubSpot API integration is cheap to run and expensive to get wrong, because the API will happily accept the duplicate contact, the unmapped property and the association you did not mean to create. Nothing meters you, so nothing stops you either.
The rest of the category is in the CRM and sync APIs listing.
Which objects the API reaches, and what the paths look like
HubSpot publishes 63 CRM specs and another 30 outside the CRM, which is more surface than any other provider here. The objects people search for by name live inside it: the HubSpot email API sits under engagements, the HubSpot forms API owns a table row of its own below, and the HubSpot search API is a search variant on the CRM objects rather than a family of its own. The shape still repeats: every object gets the same seven operations, so once you have written against one of the HubSpot contacts API endpoints you have written against all of them. Paths carry the version in the middle, not the front.
| API family | What it covers | Current version |
|---|---|---|
| Core records | The HubSpot contacts API, companies, deals, tickets and leads. The four objects every GTM pipeline writes to. | 2026-09 |
| Associations | The HubSpot associations API, which links a contact to a company to a deal. Has its own stricter limits. | 2026-09 |
| Custom objects | The HubSpot custom objects API plus schemas, for records HubSpot does not ship. | 2026-09 |
| Properties | The HubSpot properties API, property validations and property history. Where field mapping lives. | 2026-09 |
| Engagements | Calls, emails, meetings, notes, tasks and postal mail. The HubSpot engagements API as six separate specs. | 2026-09 |
| Owners and users | The HubSpot owners API and users API, for assignment and routing. | 2026-09 |
| Lists and imports | The HubSpot lists API and the import API, for bulk loads that do not go through batch upsert. | 2026-09 |
| Quotes and line items | Quotes, line items, products, invoices, discounts, fees and taxes. | 2026-09 |
| Transactional email | The HubSpot transactional email API, sent through single send. Partly exempt from rate limits. | 2026-09 |
| Conversations | The HubSpot conversations API, custom channels and visitor identification. | 2026-09 |
| Events | The HubSpot events API: definitions, completions and reads. Capped separately, see below. | 2026-09 |
| Webhooks | The HubSpot webhooks API and the webhooks journal, for push rather than poll. | 2026-09 |
| Automation | Sequences, workflow custom actions and email templates. The HubSpot automation API. | 2026-09 |
| Files | The HubSpot files API, for attachments on records. | 2026-09 |
| Forms | The HubSpot forms API, for form definitions and submissions. No current dated version, see below. | Legacy v3 |
Three families are worth checking before you plan around them, because they have no current dated version at all. The HubSpot forms API is on legacy v3 with a 2027-03 beta alongside it, the HubSpot knowledge base API exists only as that beta, and the HubSpot reporting API is split between a 2027-03 beta and a legacy v2. Everything else in the table above is on 2026-09. If your integration depends on one of those three, you are choosing between an old contract and an unfinished one.
Two naming points that trip people up. What HubSpot calls the public API is the documented REST surface everyone uses, as opposed to the internal endpoints behind the app, so a HubSpot public API question is almost always just an API question. And the HubSpot single send API is the transactional email endpoint, which is the one place where sending is a HubSpot call rather than something you hand to a sending provider.
Each core object exposes create, retrieve one, retrieve many, update, delete and merge, plus a batch group (create, retrieve, update, upsert, delete) and a search endpoint. Write a contact and you have written a deal. The paths put the version after the collection, as in POST /crm/objects/2026-03/contacts, POST /crm/objects/2026-03/contacts/batch/upsert and POST /crm/objects/2026-03/contacts/search. If you learned the older /crm/v3/objects/contacts shape, that is the legacy form, and it is the single most common reason a copied snippet 404s.
HubSpot API pricing, plan by plan
There is no line item called the HubSpot API. Access comes with the plan, and the plan sets your limits, so the HubSpot API cost for most GTM pipelines is zero and the real question is which tier buys enough headroom.
Free
- Full CRM object access over the API
- Free Marketing, Sales, Service, Content, Data and Revenue tools
- 100 calls per 10s, 250,000 a day
- No credit card required
Starter
- Same API, same limits as Free
- 500 HubSpot Credits included
- 1,000 marketing contacts
- From $7/seat/mo on the current new-customer offer
Professional
- 190 calls per 10s per app
- 625,000 calls a day per account
- Where the limit increase starts to matter
Enterprise
- 190 calls per 10s per app
- 1,000,000 calls a day per account
- Highest published daily ceiling
HubSpot does not print Professional or Enterprise pricing on the CRM pricing page, so this directory does not either. The Starter figure has two numbers because HubSpot is running a new-customer offer at $7 a seat against a standard $20, both stated on that page on 8 October 2026.
HubSpot sells an API Limit Increase that raises a private app to 250 calls per 10 seconds and adds 1,000,000 to the daily account ceiling, and you can buy at most two. It does not raise the limit for a marketplace-distributed OAuth app at all, which stays at 110 requests per 10 seconds per installing account whatever you pay. If you are shipping an app rather than running a pipeline, the add-on is not the fix.
Two windows, and only one of them is yours
HubSpot API rate limits are set by the subscription of the account your app runs in, not by what you bought as a developer. There are two windows and they behave differently, which is the single most useful thing to know before you design a batch job.
| Product tier | Per 10 seconds | Per day | Scope of the daily cap |
|---|---|---|---|
| Free and Starter | 100 / app | 250,000 | Shared across every app in the account |
| Professional | 190 / app | 625,000 | Shared across every app in the account |
| Enterprise | 190 / app | 1,000,000 | Shared across every app in the account |
| Any tier, with API Limit Increase | 250 / app | +1,000,000 | Per increase, maximum of two |
| Marketplace OAuth app | 110 / 10s | Not published | Per account that installs your app |
Endpoints with their own limits
Four APIs are documented as stricter than, or separate from, the general limits. Read their own guides before you scale against them.
- CRM Search API, which is also excluded from the marketplace app limit.
- Associations API, when you batch associate records.
- GraphQL API, which is capped on query complexity rather than call count.
- Exports API, limited in its own guide.
What is exempt, and the catch
Some endpoints sit outside both windows, including parts of the marketing single send and source code APIs.
- Exempt requests are not logged in HubSpot, so if you need an audit trail you have to keep it yourself.
- A high rate against an exempt endpoint returns 5xx rather than 429, and wants the same backoff.
- Custom events cap at 500 unique definitions per account and 30 million completions a month.
- The send custom event completions endpoint takes up to 1,250 requests a second.
The burst limit is per app, so two apps each get their own 100 or 190 calls per 10 seconds. The daily limit is not: every app in the account draws on the same 250,000 or 625,000. A nightly sync that burns the day's allowance takes the CRM integration your reps rely on down with it, and nothing in the HubSpot interface warns you first. Give the batch job a budget in your own code.
How to create a HubSpot API key
HubSpot has two ways in and the right one depends on who installs the thing you are building. For a pipeline that writes to one HubSpot account, a private app token is the whole job: create the app in that account, pick its scopes, copy the token. For anything distributed to accounts you do not own, OAuth 2.0 is required rather than preferred.
Private app token
The route for a GTM pipeline, an internal tool or a one-account integration.
- Created inside the HubSpot account itself, under the developer settings for that account.
- Scoped at creation: the app can only reach the object types and actions you selected.
- Sent as Authorization: Bearer <token>, and it does not expire.
- Counts against the private app limits in the table above, per app.
OAuth 2.0
Required for anything installed in accounts you do not control.
- HubSpot documents OAuth as mandatory for distributed apps, not as the recommended option.
- The access token carries an expires_in, and you are responsible for storing the TTL and refreshing.
- A 401 is not a valid signal that the token needs refreshing. HubSpot says so explicitly.
- Marketplace-distributed OAuth apps get 110 requests per 10 seconds per installing account.
A Super Admin on the account can review API call usage against the account limits from HubSpot's account management screens, which is the only place the daily figure is visible. Build the check into your own monitoring anyway: the number that matters is the account total, and the person who can see it is usually not the person who wrote the job.
Where the HubSpot API documentation lives
HubSpot moved its API reference to date-based versioning, which means a doc URL you bookmarked two years ago may now 404 while the content sits one path over. These are the five surfaces that are current as of 8 October 2026, all confirmed resolving.
| Surface | Where | What it answers |
|---|---|---|
| HubSpot API docs | developers.hubspot.com/docs | The whole developer site, and the right place to start. |
| API reference | developers.hubspot.com/docs/api-reference/latest/overview | Per-endpoint reference, on the latest dated version. |
| Usage guidelines | /docs/developer-tooling/platform/usage-guidelines | Every rate limit in the table above, plus the API-specific ones. |
| Changelog | developers.hubspot.com/changelog | Version releases and breaking changes. Worth a subscription. |
| llms.txt | developers.hubspot.com/docs/llms.txt | The full page index as Markdown, plus every OpenAPI spec by version. |
That last surface is the useful one if an agent writes your HubSpot code. The index lists an OpenAPI JSON spec per dated version, so a coding assistant can read the current contract for the version you are pinned to rather than the shape it remembers. Point it at the llms.txt before asking for HubSpot code, not after.
HubSpot also maintains four official client libraries, for Node, Python, PHP and Ruby. A HubSpot API client handles auth, retries and pagination for you, which is most of what people write by hand on the first attempt, and the HubSpot API Python library is the one most GTM scripts here end up using. The SDK docs sit under /docs/developer-tooling/sdks.
HubSpot also ships an MCP server, and it is on the MCP page with the others in this directory.
HubSpot's own walkthrough of the API
HubSpot publishes this on its own channel, so it is HubSpot's account of HubSpot, not ours. It is here because a rate card cannot show you the thing moving, and a few minutes of the product is faster than any paragraph on this page at telling you whether the shape of it fits yours.
YouTube · HubSpot Developers Migrating from the API key to private apps examples with Postman and custom coded actions 6:10 · Published July 2022Narrow, and still the most useful video on HubSpot's developer channel for this page: moving an integration off an API key and onto a private app, in Postman and in a coded action. HubSpot has since retired API keys, so this is the migration everybody had to do and the auth model described above.
Published 28 July 2022 on HubSpot Developers, the channel HubSpot's own pages link to, and read on 13 October 2026. Nothing in it is a source for a price or a limit on this page: every figure in the tables above comes from a HubSpot page.
Strengths and limits
HubSpot is in this directory as a destination rather than a data source, and it should be judged on that job.
What it does well
- API access on the free tier, including full CRM object access, which no other CRM here matches.
- No metering on reads or writes, so volume changes your rate limit problem and never your bill.
- Genuinely wide surface: objects, associations, custom objects, properties, workflows, forms, events and transactional email.
- Two official MCP servers, one remote for CRM access and one local for builds.
- Batch upsert endpoints, which turn an enrichment run into a handful of calls rather than thousands.
Where it falls short
- The shared daily cap means one careless job starves the rest.
- 100 calls per 10 seconds on Free and Starter is tight for a real backfill, and the fix is a plan upgrade rather than an API setting.
- The API Limit Increase add-on does nothing for a marketplace-distributed app.
- Professional and Enterprise pricing is not published on the CRM pricing page, so the cost of more throughput is a sales conversation.
- Date-based doc versioning means old links rot, and a 401 does not mean what you would assume it means.
Where HubSpot data comes from, and what you may do with it
The question that arrives late and expensively is not how good the data is, it is who is allowed to hold it. These are the fields each one returns, the coverage it claims and the compliance it publishes.
| Provider | Fields returned | Coverage | Compliance | Redistribution |
|---|---|---|---|---|
| HubSpot API | CRM records, Work email, Firmographics | Global | GDPR DPA SOC 2 Type II CCPA | Not stated |
None of these states a redistribution position on its pricing or docs pages. Internally that never matters. Put the rows in something your customers can see and it becomes the question your legal team asks first.
Two practical notes that apply to every provider on this page. A compliance badge describes the vendor, not your use of it, so a GDPR DPA does not give you a lawful basis for the outreach you send. And every one of these vendors runs its own opt-out, which means a person who asks you to delete their record has to be removed from your copy as well as from theirs.
If HubSpot is not the answer
Four providers in the CRM and sync APIs listing that solve the same problem differently. Each one is a trade, and the trade is named.
Attio
$44/user/moThe closest like-for-like if the data model is what pinches: objects and attributes defined through the API, and a free plan with full REST access to test it on.
Pipedrive
US$14/seat/moUS$14 a seat, API access on every plan, and a pipeline that works without configuration. The answer when the suite was the problem.
Salesforce
US$125/seat/moThe move when the org has outgrown an opinionated CRM entirely: more than a dozen APIs, real metadata and deployment tooling, and a ceiling that scales with licenses.
Clay
$167/moNot a CRM. Named here because a good share of HubSpot frustration is really about enrichment, and if the rows are the problem then changing CRM fixes nothing.
The full set, organized by the reason people leave, is on the HubSpot alternatives page.
HubSpot against the obvious rival
Same rate cards, read side by side, with the arithmetic done on a worked volume rather than left to you: HubSpot vs Attio, HubSpot vs Salesforce, HubSpot vs Pipedrive and Clay vs HubSpot.
The same again, against the rest of the field: HubSpot vs Zoho CRM, Apollo vs HubSpot, HubSpot vs Close and HubSpot vs Freshsales.
Every pairing in the directory is on the compare hub.
HubSpot vs Attio
CompareA free CRM API against a CRM whose data model you define in code.
HubSpot vs Salesforce
CompareA CRM that gives the API away against one that sells it by the seat.
HubSpot vs Pipedrive
CompareA free tier with a per-second rate limit against a $14 seat with a daily token budget.
Before you build against it
Four things to settle first, each one read off HubSpot's own pages. The ticks are remembered in this browser, so you can come back to a half-finished integration.
Who should actually buy this
Nearly everyone running outbound already has HubSpot, which makes this less a buying decision than a design one. The question is not whether to use the HubSpot API, it is whether your tier has the throughput for what you are about to build.
If you are landing enriched rows for reps to work, the free tier is genuinely enough: batch upsert, 250,000 calls a day, no metering. If you are backfilling a few hundred thousand records, or running several integrations at once, the shared daily ceiling will find you before the burst limit does, and Professional is the answer rather than the add-on.
If you are building a product other companies install, read the marketplace limit first and design to 110 requests per 10 seconds per customer. That number does not move, whatever you spend.
HubSpot is one of the providers in the inbound speed to lead stack on this site, where the cost is worked out end to end at $59 a month.
The CRM is the easy part. What lands in it is not.
A free API makes it tempting to write everything to HubSpot and sort it out later. The teams that regret it are the ones who did. HubSpot API development is rarely the hard part: the routing, the dedupe and the property mapping are, and they are cheaper to get right before the first row lands than after a hundred thousand. That is the HubSpot API consulting work Frontal actually does, inside your own portal, on tooling you keep.
Worked with 300+ companies. A senior operator runs your account.
What HubSpot users say, in their own words
The one part of this page that is not a vendor claim. Quotes are transcribed as written and linked to the thread.
The per-app rate limit is why people end up running several private apps
API limits are not being respected or the sync isn't really set up in a way that someone with knowledge of the api. They may not be using a queue system. They haven't optimized and paid attention to api limits. [...] This may need to be done using multiple private app keys because you are hitting specific limits. [...] If these updates are happening all at once, batch and import/export APIs are the way to go
r/hubspot · April 2025 · 2 points
This corroborates the shape of HubSpot's limits rather than the numbers. The rate, 100 requests per 10 seconds on Free and Starter and 190 on Professional, is per app, which is exactly why splitting work across several private apps raises throughput at all.
The part that is easy to miss is that the daily cap is not per app, so the same trick does nothing for it. Splitting a sync across three private apps triples the requests a second you can make and shares one daily budget between them, which is a fix for the wrong half of the problem if the daily cap is what you were hitting.
The search endpoint is the one to design around
When building custom integrations or custom data migrations, always set the external ID as a unique property so you can use the unique identifier endpoint to read/query records... instead of using the search endpoint which has a 5 calls per second limit. Use batch endpoints as much as possible.
r/hubspot · August 2025 · 10 points
The same lesson the Pipedrive side of this directory records as a token cost, arriving here as a separate rate. Search is the expensive call on every CRM in this listing and it is the one a first integration reaches for, because searching by email is the obvious way to find a contact when you have not stored its id.
Storing an external id on creation is the fix in both products, and it is cheaper to do on day one than to retrofit. Treat this as a design note rather than as a published figure: HubSpot's own documentation is the authority on the per-endpoint limits.
14 threads read on 13 October 2026, searched by vendor name. Scores and dates are the comment's own. Nothing here is the only source for a price or a limit on this site: every figure in the tables above comes from a vendor's own page.
HubSpot API, answered
Is the HubSpot API free?
Free CRM including API access.
How much does the HubSpot API cost?
Nothing, to start with: HubSpot puts API access on its free tier, and calls are not metered. Billing is free tier, subscription and per seat. Read from HubSpot's own pricing page on 8 October 2026.
What are the HubSpot API rate limits?
100 req/10s on Free and Starter, 190 on Professional. Daily cap shared across apps.
How do I get a HubSpot API key?
Private app token or OAuth 2.0. The current steps are in HubSpot's own documentation, which is authoritative on anything that has changed since 8 October 2026.
Does HubSpot have an MCP server?
Yes. Official remote and local servers. It is listed with the others on the MCP page.