Yes. HubSpot has a public API reference using date-based versions such as 2026-09 (as of Nov 2026), with every endpoint served from api.hubapi.com. Apps use OAuth, or a static auth token if built for a single account. Limits depend on your subscription tier: privately distributed apps get 100 to 190 requests per 10 seconds per app.
Yes, and it versions by date
If you're commissioning an integration, or wondering whether your CRM can talk to another tool, the short answer is yes. The thing that surprises people is how it's versioned. Instead of v1, v2 and v3, HubSpot uses dates. Right now (as of Nov 2026) the API reference shows paths like /crm/2026-09/, following the earlier 2026-03 version.
Three rules come with that:
- All APIs, whether legacy, new or beta, use the same root, api.hubapi.com.
- When a new date version is released, the previous one keeps working until its end-of-life date.
- New integrations should always use the latest date version.
So when a developer quotes for a build, ask which date version they're targeting. An integration written against an old version will need updating when that version reaches end of life.
How apps sign in
Apps must use HubSpot's OAuth protocol, or a static auth token if the app is installed in a single account. For a business connecting its own HubSpot account to an internal tool, the static token route is the simpler one. For an app you'll install in clients' accounts, it's OAuth.
Super Admins can review API call usage, which is the first place to look if an integration starts failing.
Request limits by tier
| App type and tier | Burst limit | Daily limit |
|---|---|---|
| Publicly distributed OAuth apps | 110 per 10 seconds per installing account (excluding CRM Search) | Not stated here |
| Private apps, Free and Starter | 100 per 10 seconds per app | 250,000 per day per account |
| Private apps, Professional | 190 per 10 seconds per app | 625,000 per day per account |
| Private apps, Enterprise | 190 per 10 seconds per app | 1,000,000 per day per account |
There are structural limits too: up to 100 legacy public apps per developer account, 20 legacy private apps per HubSpot account and 1,000 webhook subscriptions per app. Webhooks are worth using wherever you can, because they tell you about changes instead of making you ask. My explainer on APIs versus webhooks covers why.
Search and associations throttle first
The HubSpot Developer Docs flag the trap. The Associations, CRM Search and GraphQL APIs have limits that are unique from, or stricter than, the general ones. That's why a script that works perfectly in testing, with a handful of records, can be throttled in production when it searches thousands. If your integration leans on search to find contacts, plan for those tighter limits from the start, and look at whether a webhook can replace repeated searching.
What a small business can do with it
You don't need to write code yourself. Common jobs are syncing contacts from a booking tool, pushing deals from a quote system, or pulling reporting data into a dashboard. Before you reach for the API, check whether a workflow already does what you need; my HubSpot workflow recipes cover a lot of those cases without any development.
Questions to ask before you approve a build
- Which date version will the integration use, and when does it reach end of life?
- Will it sign in with a static token for our account, or OAuth?
- Does it lean on CRM Search or Associations, and how will it stay under their stricter limits?
- Could a webhook subscription replace any scheduled polling?
A developer who can answer those four clearly has read the docs. One who can't is likely to build something that works on day one and breaks at scale.
Other CRMs with public APIs
Pipedrive publishes an API reference with endpoints for deals, persons, organizations, leads and more.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Zoho CRM's V8 APIs include core CRUD APIs, bulk APIs, notification APIs and query APIs using SQL-style SELECT.
If you're choosing a CRM with integration in mind, my comparison of HubSpot and Pipedrive is a good place to start.
My verdict on building an integration
HubSpot's API is mature and well documented, and its date versioning makes change predictable. Use the latest date version, pick a static token for your own account or OAuth for client installs, and plan around the stricter search limits. If a workflow can do the job, use that first and save the API for what it can't.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
What's HubSpot's API base URL?
Every endpoint is served from api.hubapi.com.
How does HubSpot version its API?
With date-based versions such as 2026-09 (as of Nov 2026).
How do apps authenticate?
With OAuth, or a static auth token for a single-account app.
What are the burst limits?
Privately distributed apps get 100 or 190 requests per 10 seconds per app, depending on tier.
Are there daily limits?
Yes, from 250,000 to 1,000,000 per day per account on private apps, depending on tier.
