--- title: "HubSpot API: Authentication, Endpoints & Rate Limits" url: "http://35.223.47.52/blog/hubspot-api/" date: "2026-06-20T00:00:00+00:00" modified: "2026-08-22T15:11:15+00:00" type: "post" --- # HubSpot API: Authentication, Endpoints & Rate Limits [Blog](http://35.223.47.52/blog) / [Developers](http://35.223.47.52/blogs/developers/) / HubSpot API: Authentication, Endpoints & Rate Limits [Developers](http://35.223.47.52/blogs/developers/) · June 20, 2026 HubSpot API: Authentication, Endpoints & Rate Limits ======================================================== ![](https://storage.googleapis.com/knit-website-media/2026/08/64c34c8eb1ffc79e7f787ecd_Akshat-3-150x150.png)Akshat Jain 6 min read [](https://www.linkedin.com/sharing/share-offsite/?url=http%3A%2F%2F35.223.47.52%2Fblog%2Fhubspot-api%2F) [](https://twitter.com/intent/tweet?url=http%3A%2F%2F35.223.47.52%2Fblog%2Fhubspot-api%2F&text=HubSpot%20API%3A%20Authentication%2C%20Endpoints%20%26%23038%3B%20Rate%20Limits) Table of Contents - [Authentication](#authentication) - [Common tasks](#common-tasks) - [Rate limits and pagination](#rate-limits-and-pagination) - [Build it yourself vs. use a unified API](#build-it-yourself-vs-use-a-unified-api) - [Knit’s HubSpot connector and AI/MCP](#knits-hubspot-connector-and-ai-mcp) - [FAQ](#faq) The HubSpot API is the REST interface for reading and writing CRM data – contacts, companies, deals, tickets, and their associations – under `/crm/v3/` (and `/crm/v4/` for associations). It authenticates with a bearer token (a Service Key, a private app access token, or an OAuth access token), returns JSON, and is rate-limited per second and per day based on your HubSpot subscription. This page covers how authentication works, the endpoints and objects you’ll use most, rate limits and pagination, and where Knit’s unified API and MCP server fit if you’re connecting HubSpot alongside other CRMs. Authentication -------------- HubSpot retired its legacy static API keys in 2022. Today, API calls are authenticated with a bearer token from one of three sources: a **Service Key** (account-level, data-only, in public beta since February 2026), a **private app access token** (supports webhooks and UI extensions), or an **OAuth 2.0 access token** from a project-based app (required for Marketplace or multi-account integrations). All three are sent the same way: `Authorization: Bearer ` ([HubSpot Developers, Account Service Keys](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/account-service-keys)). For the full walkthrough — creating a Service Key or private app, choosing between them, and a working curl example – see [How to Get a HubSpot API Key.](/blog/hubspot-api-key/) ResourceExample endpointWhat it’s forContacts`GET/POST/PATCH /crm/v3/objects/contacts`Create, read, update people recordsCompanies`GET/POST/PATCH /crm/v3/objects/companies`Create, read, update organization recordsDeals`GET/POST/PATCH /crm/v3/objects/deals`Create, read, update sales opportunitiesTickets`GET/POST/PATCH /crm/v3/objects/tickets`Create, read, update support ticketsSearch`POST /crm/v3/objects/{objectType}/search`Filter and sort any CRM object by property valuesAssociations`GET/PUT /crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}`Link records together (e.g., a contact to a deal)Properties`GET /crm/v3/properties/{objectType}`List standard and custom fields for an object type The full, current set of endpoints and required scopes is in HubSpot’s CRM API documentation – check each endpoint’s page before assuming a token has access. Common tasks ------------ - **Create a contact**: `POST /crm/v3/objects/contacts` with a `properties` object containing fields like `email`, `firstname`, `lastname`. - **Update a deal**: `PATCH /crm/v3/objects/deals/{dealId}` with the `properties` to change, such as `dealstage` or `amount`. - **Search records**: `POST /crm/v3/objects/{objectType}/search` with `filterGroups`, `sorts`, and `properties` to return — the shared 5 requests/second Search API limit applies regardless of object type. - **Associate records**: `PUT /crm/v4/objects/{objectType}/{objectId}/associations/{toObjectType}/{toObjectId}` to link, for example, a contact to a company or deal. - **List custom fields**: `GET /crm/v3/properties/{objectType}` to see which standard and custom properties exist before reading or writing them. - **Fetch open support tickets**: see Knit’s walkthrough on [how to fetch open tickets from the HubSpot API](/blog/how-to-fetch-open-tickets-from-the-hubspot-api/) for the properties lookup, pagination, and per-contact filtering involved. Rate limits and pagination -------------------------- HubSpot enforces both **per-second (burst)** and **daily** rate limits, scoped to your account and subscription tier, documented at [HubSpot’s API usage guidelines and limits](https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines): Credential / tierBurst limitDaily limitService Key / private app — Free or Starter100 requests / 10 sec250,000 / dayService Key / private app — Professional190 requests / 10 sec (250 with the API limit increase add-on)625,000 / day (+1,000,000 per add-on, max 2 add-ons)Service Key / private app — Enterprise190 requests / 10 sec (250 with the API limit increase add-on)1,000,000 / day (+1,000,000 per add-on, max 2 add-ons)OAuth (project-based app, marketplace-distributed)110 requests / 10 sec per connected account (add-on does not increase this)No daily limit tracked for OAuth-authenticated callsSearch API (any object type)5 requests / sec, shared across all object types— Every response includes `X-HubSpot-RateLimit-Max` and `X-HubSpot-RateLimit-Remaining` (the burst limit and remaining requests for the current window, with the window length given in `X-HubSpot-RateLimit-Interval-Milliseconds`), plus – for non-OAuth credentials – `X-HubSpot-RateLimit-Daily` / `X-HubSpot-RateLimit-Daily-Remaining`. The older `X-HubSpot-RateLimit-Secondly` / `X-HubSpot-RateLimit-Secondly-Remaining` headers are still sent but are deprecated and no longer enforced – don’t build new logic against them. Search API responses don’t include any of these rate-limit headers. Exceeding a limit returns `429` with a JSON body containing `errorType: "RATE_LIMIT"` and a `policyName` of `SECONDLY` or `DAILY` telling you which limit you hit. For pagination, list and search endpoints under `/crm/v3/` and `/crm/v4/` use **cursor pagination**: each response includes a `paging.next.after` value, which you pass back as the `after` query parameter to fetch the next page. Keep paging until `paging.next` is absent from the response. Build it yourself vs. use a unified API --------------------------------------- Calling the HubSpot API directly works well for a single account: pick the right credential (Service Key, private app, or OAuth), track per-second and daily limits, and handle cursor pagination on list and search endpoints. It gets more involved once you’re connecting HubSpot alongside other CRMs – each with its own auth model, object schema, and rate-limit shape. Knit’s [unified CRM API](/integration-categories/crm-api) normalizes HubSpot contacts, companies, deals, and tickets alongside connectors like Salesforce behind one schema, handles the auth setup described in the [HubSpot API key guide](/integration/hubspot/api-key), and manages rate-limit backoff for you. See [Knit’s HubSpot connector](/integration/hubspot) for what’s available, or [talk to a human](/book-demo) to see it against your own account. You can also [sign up free](https://dashboard.getknit.dev/signup) and connect a sandbox HubSpot account. Knit’s HubSpot connector and AI/MCP ----------------------------------- Knit also runs a [HubSpot MCP Server](/mcp-servers/hubspot-mcp-server), which gives AI agents read/write access to HubSpot CRM objects – contacts, companies, deals, custom objects and fields – through the same unified layer, so an agent built against Knit’s MCP doesn’t need separate HubSpot-specific auth or endpoint logic. FAQ --- **Is the HubSpot API a REST API?** **‍**Yes – the HubSpot CRM API follows REST conventions (GET, POST, PATCH, DELETE on resource URLs, JSON request and response bodies) under `/crm/v3/` for most objects and `/crm/v4/` for associations. HubSpot also offers webhook subscriptions for real-time events, available to private apps and project-based apps but not Service Keys. **How do I authenticate to the HubSpot API?** **‍**Send a bearer token in the `Authorization` header: `Authorization: Bearer `. The token can come from a Service Key (data-only, no webhooks), a private app (supports webhooks), or an OAuth 2.0 flow for multi-account integrations. See the [HubSpot API key guide](/blog/hubspot-api-key/) for how to create each. **How do I paginate through HubSpot CRM records?** **‍**List and search endpoints return a `paging.next.after` value when more results exist. Pass that value as the `after` query parameter on your next request, and repeat until `paging.next` is no longer present in the response. This applies to `/crm/v3/objects/{objectType}` and the `/search` endpoints alike. **What happens if I exceed HubSpot’s API rate limits?** **‍**HubSpot returns `429` with `errorType: "RATE_LIMIT"` and a `policyName` of `SECONDLY` (burst) or `DAILY`. Burst limits range from roughly 100 to 190+ requests per 10 seconds depending on your subscription tier, with the Search API capped separately at 5 requests/second across all object types. Knit handles this backoff automatically across the HubSpot connections it manages. --- **Ready to build this integration?** Explore Knit’s [Hubspot integration](/integration/hubspot/) or read more about our [Unified CRM API](/integration-categories/unified-crm-api/). ![](https://storage.googleapis.com/knit-website-media/2026/08/64c34c8eb1ffc79e7f787ecd_Akshat-3-150x150.png)Written by Akshat Jain Coding chaos into innovation and building from zero to scale Keep Reading ------------ ![](https://storage.googleapis.com/knit-website-media/2026/08/blog-banner-yellow-scaled-640x400.png) [Tutorials](http://35.223.47.52/blogs/tutorials/) ### [How to Fetch Open Tickets from the HubSpot API](http://35.223.47.52/blog/how-to-fetch-open-tickets-from-the-hubspot-api/) Learn how to retrieve open tickets from the HubSpot API using CRM v3 endpoints. This guide covers prerequisites, endpoints, code… August 13, 2026 · 5 min read ![](https://storage.googleapis.com/knit-website-media/2026/08/blog-banner-green-640x400.png) [Developers](http://35.223.47.52/blogs/developers/) ### [How to Get a HubSpot API Key](http://35.223.47.52/blog/hubspot-api-key/) HubSpot retired static API keys in 2022. Here's how to get a working credential today - a Service Key or… June 20, 2026 · 8 min read ![](https://storage.googleapis.com/knit-website-media/2026/08/blog-banner-yellow-scaled-640x400.png) [API Directory](http://35.223.47.52/blogs/api-directory/) ### [HubSpot API Integration Guide: CRM, Contacts, Deals & OAuth (2026)](http://35.223.47.52/blog/hubspot-api-directory-od0rst/) This guide covers private app setup, OAuth 2.0 scopes, CRM endpoints, and rate limits — plus how Knit unifies HubSpot… March 16, 2026 · 29 min read \#1 in Ease of Integrations --------------------------- ![4.9 out of 5 stars](/wp-content/themes/knit/assets/images/g2/g2-star-rating.svg) 4.9 out of 5 stars on G2 ![G2 Leader, Spring 2026](/wp-content/themes/knit/assets/images/g2/g2-leader.svg)![G2 Fastest Implementation, Spring 2026](/wp-content/themes/knit/assets/images/g2/g2-fastest-implementation.svg)![G2 High Performer, Spring 2026](/wp-content/themes/knit/assets/images/g2/g2-high-performer.svg)![G2 Best Est. ROI, Spring 2026](/wp-content/themes/knit/assets/images/g2/g2-best-roi.svg) Put Integrations on Autopilot. Talk to Experts. ----------------------------------------------- Knit is loved by customers across the globe due to our seamless product and white glove support. You'll love us too! [Talk to a Human](/book-demo)