# HubSpot — CRM API: overview

> Canonical URL: https://developers.apideck.com/apis/crm/hubspot/overview

HubSpot is your all-in-one stop for all of your marketing software needs.
- Status: live
- Authentication: oauth2

- **apideck credentials note:** For testing: OAuth shows "Apideck" as the requesting application; production integrations use your own HubSpot app.
- **partnership url:** https://developers.hubspot.com/docs/apps/developer-platform/list-apps/apply-for-certification/certification-requirements
- **partnership note:** Listing in the App Marketplace makes you a HubSpot Technology Partner and adds a free listing page; developer test accounts need no partnership.
- **authentication note:** Authorization Code flow.
- **difficulty:** straightforward
- **apideck credentials available:** true
- **sandbox available:** true
- **partnership portal name:** HubSpot App Marketplace
- **sandbox url:** https://developers.hubspot.com/docs/getting-started/account-types
- **important to know:** The scopes configured on your HubSpot app must match exactly the scopes Apideck requests during OAuth. Any mismatch fails consumer authorization with an insufficient-scopes error, so update the app whenever the connector's scope set changes.
HubSpot retired its legacy app-building flow in 2026 — legacy developer accounts began migrating on March 9, 2026, and legacy public app creation was disabled for all accounts on June 23, 2026. New apps are built on the Projects-based platform; existing apps keep working.
Webhook subscriptions are app-level, not per-connection: one set, registered manually in your HubSpot app, delivers events for every connected consumer — you cannot vary event coverage per consumer.
- **difficulty reason:** Self-Service OAuth + Free Developer Tooling — No Partnership or App Review
- **environment notes:**   - **environment:** Single environment (shared credentials)
  - **description:** HubSpot uses the same app credentials for testing and production, and the API host is always api.hubapi.com. Test with a free developer test account (up to 10 per HubSpot account; expires after 90 days without API activity, renewable), your own HubSpot account, or Apideck's temporary shared test credentials (request access through Apideck Support). Be careful when testing against production data.
- **external guides:**   - **source:** HubSpot
  - **url:** https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
  - **title:** API usage guidelines and rate limits
  - **source:** HubSpot
  - **title:** Managing OAuth tokens
  - **url:** https://developers.hubspot.com/docs/api-reference/latest/authentication/manage-oauth-tokens
  - **title:** App Marketplace listing requirements
  - **source:** HubSpot
  - **url:** https://developers.hubspot.com/docs/apps/developer-platform/list-apps/listing-your-app/app-marketplace-listing-requirements
  - **url:** https://developers.hubspot.com/changelog/legacy-public-app-creation-sunset
  - **source:** HubSpot
  - **title:** Legacy public app creation sunset
- **partnership required:** false
- **responsibility matrix:**   - **apideck:** Docs provided
  - **customer:** ✓
  - **area:** Create HubSpot App
  - **apideck:** Docs provided
  - **area:** Configure Scopes & Redirect URI
  - **customer:** ✓
  - **area:** Add Credentials to Apideck
  - **customer:** ✓
  - **apideck:** Receives & forwards events
  - **customer:** ✓ (in your HubSpot app)
  - **area:** Register Webhook Subscriptions
  - **apideck:** Handles OAuth flow
  - **area:** Authorize Connection (OAuth)
  - **consumer:** ✓
  - **area:** Build via Unified API
  - **customer:** ✓
  - **apideck:** Maintains connector
  - **area:** Token Refresh
  - **apideck:** ✓ Automatic
  - **consumer:** ✓ Can revoke anytime
  - **customer:** ✓ Via Apideck Dashboard
  - **apideck:** Logs & alerts
  - **area:** Monitor Connections
- **sandbox note:** Free developer test accounts, self-service from your regular HubSpot account (up to 10).
- **consumer access level:** The authorizing user needs the App Marketplace Access permission (super admins have it by default).
- **webhooks:** Native — contact, company and opportunity created/updated/deleted events; no engagement (activity or note) events.
- **account type required:** Any HubSpot edition, including the free CRM.
- **supported resource categories:**   - **resources:** contacts
leads
companies
  - **name:** Contacts & Companies
  - **name:** Sales Pipeline
  - **resources:** opportunities
pipelines
stages
  - **name:** Engagements
  - **resources:** activities
notes
calls
  - **resources:** lists
list-members
  - **name:** Lists & Segments
  - **name:** Users & Custom Fields
  - **resources:** users
custom-fields
- **rate limits:** 110 requests per 10 seconds per connected account for publicly-distributed OAuth apps; the CRM Search API is separate at 5 requests/second.
- **costs:** None — HubSpot developer tooling and public apps are free to build and distribute.

## Supported resources

- **id:** contacts
- **downstream id:** contacts
- **status:** live
- **downstream name:** Contacts
- **custom field support:** true
- **name:** Contacts
- **id:** leads
- **custom field support:** true
- **name:** Leads
- **downstream id:** leads
- **downstream name:** Leads
- **status:** live
- **custom field support:** true
- **downstream name:** Companies
- **name:** Companies
- **id:** companies
- **downstream id:** companies
- **status:** live
- **name:** Opportunities
- **custom field support:** true
- **id:** opportunities
- **status:** live
- **downstream name:** Deals
- **downstream id:** deals
- **custom field support:** false
- **name:** Pipelines
- **downstream id:** pipelines
- **downstream name:** Pipelines
- **id:** pipelines
- **status:** live
- **id:** activities
- **name:** Activities
- **downstream name:** Engagements
- **status:** live
- **custom field support:** false
- **downstream id:** engagements
- **status:** live
- **custom field support:** false
- **id:** notes
- **downstream name:** Notes
- **downstream id:** notes
- **name:** Notes
- **status:** live
- **custom field support:** false
- **downstream name:** Owners
- **id:** users
- **downstream id:** owners
- **name:** Users
- **custom field support:** false
- **name:** Lists
- **downstream id:** lists
- **downstream name:** Lists
- **status:** beta
- **id:** lists

An omitted operation list does not establish operation support. Verify the selected operation in the coverage matrix.

[API reference](https://developers.apideck.com/apis/crm/reference.md) · [Coverage matrix](https://developers.apideck.com/apis/crm/coverage)