Salesforce API review
Best CRM API for enterprise integration
GET /services/data/v67.0/sobjects/Account/describe Authorization: Bearer $SF_ACCESS_TOKEN # Sforce-Limit-Info: api-usage=4213/115000 # that ceiling is 100,000 + 15 licenses x 1,000 # GET /services/data/ lists the versions your org has
Everyone asks what the Salesforce API costs and gets told it is free, which is true in the sense that there is no charge per call and false in the sense that matters. On Pro Suite, Salesforce prices the Web Services API as an add-on at $25 per user per month on top of a $100 seat. From Core at $195 a seat it is bundled. Starter Suite and Free Suite are not on the rate-limit table at all.
Of the four CRMs in this directory, Salesforce is the only one where API access is a line item you can forget to buy.
So what is API in Salesforce, exactly? There is no single answer, and that is the second thing to understand. Ask what is Salesforce API and you get more than a dozen of them: the Salesforce REST API for everyday record work, the Salesforce SOAP API for the older integrations that still run the world, Salesforce Bulk API 2.0 for loads, the Salesforce Metadata API and the Tooling API in Salesforce for the shape of the org itself, the Salesforce Pub/Sub API for streaming, GraphQL, the Salesforce UI API, Connect REST API, and the newer Salesforce Agentforce API surfaces.
Salesforce Marketing Cloud API is a different product on a different stack and is out of scope here. The rest share one authentication story and one budget, and they are versioned together.
That budget is the third thing, and it is where most plans go wrong. The API limit in Salesforce is not a requests-per-second ceiling and it is not per user. It is a 24 hour allocation for the whole org, calculated from how many licenses you bought, and every integration you run draws on the same pool. This is the one API Salesforce limits by the day rather than by the second, which makes the arithmetic unusually easy to do in advance and unusually easy to ignore until a nightly job stops at 3am for a reason nobody connects to a seat count.
The rest of the category is in the CRM and sync APIs listing.
The Salesforce API is a family, not an endpoint
Picking the wrong member of this family is the most expensive mistake available here, because the limits, the tooling and the retirement dates all differ. Every row below is a separate API with its own reference in Salesforce's developer documentation, and all of them draw on the one daily org budget.
| API | What it is for | Worth knowing |
|---|---|---|
| Salesforce REST API | Records, queries and describes. The default for new work. | Base path /services/data/vXX.X/, or the latest alias. Most people searching for a RESTful Salesforce integration want this one. |
| Salesforce SOAP API | The same object model over SOAP, for older integrations. | Still supported. The Salesforce SOAP API retirement that matters is login() by username and password, which goes in Summer 27. |
| Salesforce Bulk API 2.0 | Asynchronous loads and extracts of large record sets. | The Salesforce API bulk route for imports. Submit a job, upload a CSV, poll it. |
| Salesforce Query API | SOQL over HTTP, through the /query resource. | Reading a list is one call no matter how many rows come back, which is the cheapest pattern available. |
| Salesforce Composite API | Several REST subrequests in one round trip. | The 20 second timeout applies to the whole composite request, not to each subrequest. |
| Salesforce Pub/Sub API | Event streaming, the successor to the older streaming API. | For change data capture and platform events. The Salesforce streaming API name still turns up in older guides. |
| GraphQL API | One query across related objects. | Summer 26 added chaining, so a mutation can reference any field an earlier operation in the same request returned. |
| Salesforce Metadata API | The shape of the org: objects, fields, layouts, permissions. | Deployment tooling rather than record traffic. This is how orgs get promoted between environments. |
| Salesforce Tooling API | Apex, triggers, debug logs and developer metadata. | What IDEs and the Salesforce DX tooling are built on. |
| Salesforce Connect REST API | Chatter, communities, files and feeds. | A different object model from the sObject one. Not the same thing as Salesforce Connect, the external data feature. |
| Salesforce Reports API | Run a report and read its rows. | What people mean by the Salesforce report API or the Salesforce reporting API. Reports are objects too. |
| Salesforce UI API | Records plus the layout metadata needed to render them. | For building interfaces, not for syncing. |
Nearly all of this hangs off one base URI: https://MyDomainName.my.salesforce.com/services/data/vXX.X/resource/. Replace the version, or use the latest alias and let Salesforce resolve it to the most recently released version on its own. sObject resources cover standard and custom objects alike, so a custom object behaves exactly as Account does. Parts of the URI are case sensitive, notably record IDs, and parts are not, notably object and field names, which is a common first-hour failure.
API versions 21.0 through 30.0 are already gone: the Salesforce REST API answers 410 GONE, SOAP answers 500 UNSUPPORTED_API_VERSION and Bulk answers 400 InvalidVersion. Versions 31.0 through 40.0 are still supported, deprecated in Summer 27 and retired in Summer 28. Separately, and sooner, SOAP login() in versions 31.0 through 64.0 retires in Summer 27, which breaks any integration that signs in with a username and password rather than OAuth. The version retirement gives you two years. The login retirement gives you one, and it is the one nobody has diarised.
Salesforce API pricing, plan by plan
Salesforce API pricing is really edition pricing, and the API is the feature that moves between editions. Salesforce lists six Sales Cloud tiers. The one that matters for an integration is the step from Pro Suite to Core, because that is where the Web Services API stops being an add-on.
Starter Suite
- Sales, service, marketing and commerce in one
- Slack included at no extra cost
- Not listed on the API rate-limit table
Pro Suite
- Web Services API available for an extra $25/user/mo
- So US$125/user/mo all in, the cheapest API access here
- 5 flows per org
Core
- APIs included, no add-on
- Forecasting, opportunity scoring, conversation intelligence
- Agentforce with the free Salesforce Foundations add-on
Advanced
- APIs included
- 1 Full Sandbox included per org
- Everything in Core plus advanced automation
Max
- APIs included
- Slack Enterprise+ included
- The complete suite
Prices are the published US rate per user per month, billed monthly or annually. There is also a Free Suite at $0, which like Starter Suite does not appear on the API allocation table. Add-ons are priced separately on top: Agentforce for Sales from $125 per user per month, Sales Programs from $100, Revenue Intelligence from $220, Revenue Cloud from $200 and Partner Relationship Management from $10 per login per month.
Pro Suite at $100 plus the $25 Web Services API add-on is the cheapest honest way to call the Salesforce API, and it is charged per user rather than per integration, so a 20 seat team pays $2,500 a month before anyone writes a line of code. Compare the two other CRMs reviewed here: HubSpot includes API access on a genuinely free tier, and Pipedrive includes it in a $14 seat. The Salesforce API is deeper than either of them. It is also between nine times and infinitely more expensive to reach, and the usual reason to pay that is that the org is already there.
One daily budget for the whole org
Salesforce API rate limits are a 24 hour allocation for the entire org rather than a rate per second. The formula Salesforce publishes is 100,000 calls plus the number of licenses times the calls that license type carries, plus any API Call Add-Ons you have bought. API limits in Salesforce are enforced against the aggregate of every call the org makes, not per user, so how many API calls Salesforce allows you is a licensing question before it is an engineering one.
| Edition | Calls per Salesforce license | Daily org total | Example |
|---|---|---|---|
| Enterprise, or Professional with API access enabled | 1,000 | 100,000 + licenses x 1,000 | 15 licenses gives 115,000 a day |
| Unlimited and Performance | 5,000 | 100,000 + licenses x 5,000 | 15 licenses gives 175,000 a day |
| Developer Edition | n/a | 15,000 | Flat, and free to build against |
| Full Sandbox | n/a | 5,000,000 | Unless it was created from a template |
| Salesforce Platform license | 1,000 | Counts the same as a full license | Lightning Platform One App gives 200 |
| Partner or Customer Community | 0 to 200 | Login licenses give 10 | Community seats are not an API budget |
What counts as an API call in Salesforce
Aggregate org traffic, not per user.
- Every REST, SOAP and Bulk request against the org, from every integration, draws on the same figure.
- API calls in Salesforce made by installed managed packages count against your org limit too.
- Anything a person does in the Salesforce interface is free and uncounted.
- Calls carrying DebuggingHeader have a separate 1,000 a day allocation and keep working after the main limit is reached.
- Purchased API Call Add-Ons raise the daily figure.
Concurrency is a separate limit
Only long requests count.
- Requests running 20 seconds or longer: 25 at once in production orgs and sandboxes, 5 in Developer Edition and trials.
- There is no limit at all on the number of concurrent requests shorter than 20 seconds.
- Over the concurrency limit returns REQUEST_LIMIT_EXCEEDED until fewer are running.
- Over the 20 second timeout returns QUERY_TIMEOUT on REST and REQUEST_RUNNING_TOO_LONG on SOAP.
How to watch it
Four places, one of them in every response.
- The Sforce-Limit-Info response header, on every REST call, carries your usage and your ceiling.
- The /limits REST resource reports the same thing on request.
- API Usage on the System Overview page in Setup, and the Salesforce API Request Limit per Month entitlement on Company Information.
- API Usage Notifications will email a nominated user when usage passes a percentage you choose.
Salesforce lets a paid org in active status exceed the API limit Salesforce set for it by some amount rather than blocking work during a spike, with a hard cap behind that to protect the instance. It is explicit that this is for occasional use and not something to build on, it does not apply to trials, Developer Edition or sandboxes, and usage is aggregated into 30 day periods from your contract date. Treat the daily number as the budget and the overage as weather.
Two more Salesforce rate limits worth knowing: the combined URI and headers on a REST call cannot exceed 16,384 bytes, which returns 414 or 431, and Salesforce recommends staying under 2,000 characters of URI for anything public facing. The Bulk API limit Salesforce applies is the same daily pool, so Salesforce batch API limits are not a separate allowance, which is exactly why a loop over REST and a bulk job can starve each other.
How to create a Salesforce API key
There is no Salesforce API key in the sense other vendors mean, and searching for Salesforce API keys is how people end up with a credential that is about to stop working. Salesforce API authentication is OAuth 2.0, and access is gated in three separate places: the edition you bought, the permission on the user, and the scopes on the connected app.
OAuth 2.0
The route for everything new.
- An access token is sent as Authorization: Bearer, against your org's My Domain host.
- For server to server work, use external client apps with JWT.
- Salesforce stores third party access and refresh tokens of up to 10,000 characters.
- This is the only route Salesforce is not currently retiring.
SOAP login(), on the clock
Retires in Summer 27.
- Signing in with a username, password and Salesforce API security token over SOAP login() is retired in Summer 27, for API versions 31.0 through 64.0.
- Any integration authenticating that way stops working at the cutoff.
- Salesforce's own guidance is to move to OAuth with external client apps and JWT tokens.
- A new Any API Auth user permission controls who may still authenticate this way, and it is enforced by default in newly created orgs.
The user behind the call
Permissions, not just credentials.
- Two permission names dominate the searches here: the API Enabled permission in Salesforce, and the Use Any API Client permission Salesforce applies when an org turns on API access control. Both are real, and because Salesforce renames and re-scopes permissions between releases, its own permission reference rather than this page is the authority on what each currently does.
- An API user in Salesforce sees exactly what that user can see, so sharing rules and field-level security apply to API traffic as they do in the interface.
- Most teams create a dedicated integration user, often an API only user in Salesforce with no interface work of its own, which is what stops a sync dying on an employee's last day.
- Apex compiled at version 67.0 with no sharing keyword now defaults to with sharing, so bypassing sharing has to be deliberate.
The order to check when a call returns a permissions error is edition, then user permission, then connected app scope. Teams lose days to the middle two without realizing the first one is the problem, because Salesforce's own rate-limit table quietly describes that row as Professional Edition with API access enabled. If nobody bought the Web Services API add-on, no amount of permission editing will produce a working integration.
What a Salesforce API integration looks like
Salesforce API integration is three steps rather than one: get a token, find your version, then talk to objects. Whether you integrate with the Salesforce API directly or through a connector, the shape below is what is happening underneath, and it is worth running once by hand before you build anything, because the response header tells you your real budget rather than the one the licensing page implies.
# 1. which API versions does this org actually have? GET https://MyDomainName.my.salesforce.com/services/data/ # 2. query records. SOQL goes in the query string. GET /services/data/v67.0/query/?q=SELECT+Id,Name+FROM+Account Authorization: Bearer $SF_ACCESS_TOKEN # 3. write one back POST /services/data/v67.0/sobjects/Lead Content-Type: application/json # read Sforce-Limit-Info on the way back: # api-usage=4213/115000 is your whole org for the day
Where the Salesforce API documentation lives
The Salesforce API documentation is enormous, and the docs split by API, which is the main difficulty in using it: the answer to a REST question and the answer to a Bulk question live in different books with different version numbers on the cover. The Salesforce CRM API documentation people usually want is the REST guide plus the object reference. These are the surfaces worth bookmarking.
| Surface | Where | What it answers |
|---|---|---|
| REST API guide | developer.salesforce.com/docs/platform/api-rest | Resources, requests, headers. The Salesforce REST API documentation. |
| Object reference | developer.salesforce.com/docs/.../object_reference | Every standard object and field. What an sObject call will accept. |
| API request limits | developer.salesforce.com/docs/.../salesforce_app_limits_platform_api | The allocation table and the concurrency limits, by edition. |
| Versions resource | GET /services/data/ | The authoritative list of API versions your own org supports. |
| MCP solutions | developer.salesforce.com/docs/ai/agentforce/guide/mcp.html | Hosted MCP servers for org data, and the DX MCP server in beta. |
| Release notes | help.salesforce.com, by release | What changed in a version, and what is being retired. |
| Trust | trust.salesforce.com | Instance health, which is the first thing to check before your own code. |
Salesforce API versioning runs on the release calendar: every seasonal release ships a new version, and the latest Salesforce API version at the time of writing is 67.0, from Summer 26. Rather than hard-coding that number, call GET /services/data/, which returns every API version in Salesforce that your org supports, or put the latest alias in the path and let Salesforce resolve it. Pin whatever client you generate to a version, because versions here are retired on a published schedule rather than quietly maintained forever. For clients, Salesforce maintains SDKs and the third party ecosystem is mature, including simple-salesforce for anyone who wants a Python Salesforce API client rather than raw requests.
Salesforce also ships an MCP server, and it is on the MCP page with the others in this directory.
Salesforce's own walkthrough of the API
Salesforce publishes this on its own channel, so it is Salesforce's account of Salesforce, not ours. It is here because a rate card cannot show you the thing moving, and a few minutes of the product is faster than any paragraph on this page at telling you whether the shape of it fits yours.
YouTube · Salesforce Developers Get Started with Salesforce APIs | TDX 2026 | Developer Highlights 24:05 · Published May 2026From TDX 2026, so it is current: REST, SOAP and the authentication patterns, run by Salesforce's own developer relations team. It does not touch either of the two things that decide what a Salesforce integration costs, the per seat API add on and the daily call allocation, and both are above.
Published 7 May 2026 on Salesforce Developers, the channel Salesforce's own pages link to, and read on 13 October 2026. Nothing in it is a source for a price or a limit on this page: every figure in the tables above comes from a Salesforce page.
Strengths and limits
Salesforce is the most capable CRM API in this directory by a wide margin, and the least pleasant to buy. Both halves of that deserve to be specific.
What it does well
- The deepest API surface of any CRM here: records, metadata, deployment, streaming, bulk and GraphQL.
- Custom objects behave exactly like standard ones, so the API grows with the org.
- A daily budget of 100,000 calls plus 1,000 per license is generous for most syncs.
- The Sforce-Limit-Info header reports your remaining budget on every single response.
- Retirement schedules are published years ahead, with the exact error each retired version returns.
- Hosted MCP servers let an agent reach org data without a custom client.
- A free Developer Edition with 15,000 calls a day to build against.
Where it falls short
- API access is a $25 per user per month add-on on Pro Suite and absent below it.
- US$125 a seat a month is the cheapest route in, against free on HubSpot and $14 on Pipedrive.
- The budget is org-wide, so one unattended integration can spend the sales team's allowance.
- The allocation scales with licenses bought rather than with integration need, so the fix for a throughput problem is often a purchase.
- More than a dozen APIs with separate references, versions and retirement dates.
- SOAP login() retires in Summer 27, which will break inherited integrations.
- No per-integration quota, and nothing in the interface shows a rep why their request failed.
Where Salesforce data comes from, and what you may do with it
The question that arrives late and expensively is not how good the data is, it is who is allowed to hold it. These are the fields each one returns, the coverage it claims and the compliance it publishes.
| Provider | Fields returned | Coverage | Compliance | Redistribution |
|---|---|---|---|---|
| Salesforce | CRM records, Work email, Firmographics | Global | SOC 1 ISO 27001 ISO 42001 | Not stated |
None of these states a redistribution position on its pricing or docs pages. Internally that never matters. Put the rows in something your customers can see and it becomes the question your legal team asks first.
Two practical notes that apply to every provider on this page. A compliance badge describes the vendor, not your use of it, so a GDPR DPA does not give you a lawful basis for the outreach you send. And every one of these vendors runs its own opt-out, which means a person who asks you to delete their record has to be removed from your copy as well as from theirs.
If Salesforce is not the answer
Four providers in the CRM and sync APIs listing that solve the same problem differently. Each one is a trade, and the trade is named.
HubSpot
Free tierFull CRM object access on a genuinely free tier, so you can build the integration before anyone signs anything. The direct answer when the $125 seat was the problem.
Attio
$44/user/moA schema you define through the API itself, with the SDK and an MCP server as one platform, free to start and $44 a user after that.
Pipedrive
US$14/seat/moUS$14 a seat with API access on every plan, nine times cheaper than Salesforce API access. Right when a small team inherited an enterprise CRM.
Clay
$167/moNot a CRM, and worth naming because many Salesforce migrations are really about enrichment. If the rows were the complaint, changing CRM does not fix them.
The full set, organized by the reason people leave, is on the Salesforce alternatives page.
Salesforce against the obvious rival
Same rate cards, read side by side, with the arithmetic done on a worked volume rather than left to you: HubSpot vs Salesforce, Pipedrive vs Salesforce, Attio vs Salesforce and Salesforce vs Zoho CRM.
Every pairing in the directory is on the compare hub.
HubSpot vs Salesforce
CompareA CRM that gives the API away against one that sells it by the seat.
Pipedrive vs Salesforce
CompareUS$14 a seat with the API included against US$125 a seat before the first call.
Attio vs Salesforce
CompareDefine the schema in code for free, or buy the deepest API in the category by the seat.
Before you build against it
Four things to settle first, each one read off Salesforce's own pages. The ticks are remembered in this browser, so you can come back to a half-finished integration.
Who should actually buy this
Nobody buys Salesforce for the API, and that is the honest frame for this page. If the org already runs on Salesforce, the API is excellent and the only real work is arithmetic: count your licenses, apply the formula, and confirm somebody actually bought API access before you promise a delivery date. At Core and above it is included, and the daily allocation will comfortably carry a normal enrichment and sync workload.
If you are choosing a CRM now and the integration is the point, the price of reaching the API belongs in the comparison. HubSpot gives you CRM object access on a free tier and limits you per 10 seconds. Pipedrive includes the API in a $14 seat and limits you on a daily token budget shaped by endpoint complexity.
Salesforce asks $125 a seat before the first call and then limits you on a pool sized by how many seats you bought. For a ten person team writing one sync, that difference is most of the budget.
The one thing to do this quarter regardless: find out how your existing Salesforce integrations authenticate. SOAP login() with a username and password retires in Summer 27, the replacement is OAuth with external client apps and JWT, and the integrations most likely to be on the old route are the ones nobody has opened in five years.
An API you already pay for, and nobody has wired up.
Most Salesforce orgs are paying for API access and using it for one nightly sync. Frontal builds the plays that actually move pipeline on top of it, inside your own org, and leaves you the integration as well as the results.
Worked with 300+ companies. A senior operator runs your account.
What Salesforce users say, in their own words
The one part of this page that is not a vendor claim. Quotes are transcribed as written and linked to the thread.
Paying per seat for integrations is what pushed teams into sharing credentials
[...] I've seen SO much horrible security practise and API user sharing at small/mid size companies who just can't afford a proper full user license for each dedicated integration. Can't wait to share this news tomorrow to my boss.
r/salesforce · March 2023 · 11 points
Written when API-only licenses arrived, and it is the clearest practitioner account of what this page's pricing section describes. When a license costs US$125 a seat with the API add-on, a company with six integrations is being asked for six seats for software rather than people, and the thing that gives way is the credential.
The security consequence is the part a rate card does not show. One shared integration user across six systems means no way to tell which of them made a call, revoked access for one revokes it for all, and the daily org budget drains with no attribution. Price the integration users before you commit, not after.
The list price is a starting position, and practitioners treat it that way
They will fight you tooth and nail to maintain ACV. The trick is to figure out how to get leverage on them. [...] My standard approach: 1.Start renewals 6+ months out 2.Assess SF's current capability and how it aligns to your business goals (is it enabling you or holding you back) 3.Evaluate alternative vendors and position them to salesforce 4+ months out from renewal This playbook regularly knocks 15-30% out of a contract in a flat renewal.
r/salesforce · December 2025 · 9 points
Every figure in the cost model above is a list price, and this is the practitioner version of that caveat. A discount in this range would move three Core seats from US$585 a month to somewhere between US$410 and US$497, which changes the answer against a cheaper CRM at the margin and does not change it at the floor.
Treat the percentages as a signal rather than a number you can plan on: they are one person's experience of their own renewals, not a published rate. What is worth copying is the timing, because leverage is a function of how long you left yourself and that part costs nothing.
14 threads read on 13 October 2026, searched by vendor name. Scores and dates are the comment's own. Nothing here is the only source for a price or a limit on this site: every figure in the tables above comes from a vendor's own page.
Salesforce API, answered
Is the Salesforce API free?
No. No free tier with API access. Developer Edition is free and gets 15,000 calls a day.
How much does the Salesforce API cost?
Salesforce starts at US$125/seat/mo. Billing is per seat and subscription. Read from Salesforce's own pricing page on 8 October 2026.
What are the Salesforce API rate limits?
Daily org budget: 100,000 plus 1,000 per Enterprise license. 25 concurrent calls over 20s.
How do I get a Salesforce API key?
OAuth 2.0. SOAP login() with a username and password retires in Summer 27. The current steps are in Salesforce's own documentation, which is authoritative on anything that has changed since 8 October 2026.
Does Salesforce have an MCP server?
Yes. Hosted MCP servers, plus a DX server in beta. It is listed with the others on the MCP page.