|
4354
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis
.
call
(
'ZCARD'
,
KEYS
[
1
]
)
local
daily_used
=
tonumber...
|
Claude
|
Claude
|
NULL
|
4354
|
|
4355
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis...
|
Claude
|
Claude
|
NULL
|
4355
|
|
4356
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis
.
call
(
'ZCARD'
,
KEYS
[
1
]
)
local
daily_used
=
tonumber
(
redis
.
call
(
'GET'
,
KEYS
[
2
]
)
or
'0'
)
if
burst_used
>=
tonumber
(
ARGV
[
3
]
)
then
-- Tell caller how long to sleep until oldest entry expires
local
oldest
=
redis
.
call
(
'ZRANGE'
,
KEYS
[
1
]
,
0
,
0
,
'WITHSCORES'
)
return
{
0
,
'BURST'
,
(
oldest
[
2
]
+
ARGV
[
2
]
)
-
ARGV
[
1
]
}
end
if
daily_used
>=
tonumber
(
ARGV
[
4
]
)
then
return
{
0
,
'DAILY'
,
-
1
}
end
redis
.
call
(
'ZADD'
,
KEYS
[
1
]
,
ARGV
[
1
]
,
ARGV
[
5
]
)
redis
.
call
(
'PEXPIRE'
,
KEYS
[
1
]
,
ARGV
[
2
]
+
1000
)...
|
Claude
|
Claude
|
NULL
|
4356
|
|
4357
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After...
|
Claude
|
Claude
|
NULL
|
4357
|
|
4358
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire...
|
Claude
|
Claude
|
NULL
|
4358
|
|
4359
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis
.
call
(
'ZCARD'
,
KEYS
[
1
]
)
local
daily_used
=
tonumber
(
redis
.
call
(
'GET'
,
KEYS
[
2
]...
|
Claude
|
Claude
|
NULL
|
4359
|
|
4360
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out....
|
Claude
|
Claude
|
NULL
|
4360
|
|
4361
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2...
|
Claude
|
Claude
|
NULL
|
4361
|
|
4362
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy...
|
Claude
|
Claude
|
NULL
|
4362
|
|
4363
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,...
|
Claude
|
Claude
|
NULL
|
4363
|
|
4364
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis
.
call
(
'ZCARD'
,
KEYS
[
1
]
)
local
daily_used
=
tonumber
(
redis
.
call
(
'GET'
,
KEYS
[
2
]
)
or
'0'
)
if
burst_used
>=
tonumber
(
ARGV
[
3
]
)
then
-- Tell caller how long to sleep until oldest entry expires
local
oldest
=
redis
.
call
(...
|
Claude
|
Claude
|
NULL
|
4364
|
|
4365
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter...
|
Claude
|
Claude
|
NULL
|
4365
|
|
4366
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read...
|
Claude
|
Claude
|
NULL
|
4366
|
|
4367
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script....
|
Claude
|
Claude
|
NULL
|
4367
|
|
4368
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(...
|
Claude
|
Claude
|
NULL
|
4368
|
|
4369
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->...
|
Claude
|
Claude
|
NULL
|
4369
|
|
4370
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1...
|
Claude
|
Claude
|
NULL
|
4370
|
|
4371
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions
Analyzed independent rate limit buckets and their practical interactions
They're independent buckets — with one shared bucket on top.
The three buckets and what each call hits
The three buckets and what each call hits
Copy to clipboard
┌──────────────────┐
Search request ──→ │ Search: 5/sec │ ──┐
└──────────────────┘ │
├──→ ┌─────────────────┐
┌──────────────────┐ │ │ Daily: 250k–1M │
Non-search call ──→ │ Burst: 190/10s │ ──┘ │ (per portal) │
└──────────────────┘ └─────────────────┘
A search call is only metered against the search bucket and the daily bucket. A non-search call (batch read/update, single PATCH, associations, etc.) is only metered against the burst bucket and the daily bucket. The two short-window buckets do not share counters.
What this means practically
What this means practically
Hitting search secondly limit (5/s):
Only further
/search
calls 429. Your batch reads, batch updates, single PATCHes, association calls — all keep working at full burst speed. This is actually useful: if your sync is bottlenecked on Search, you can pivot to using
lastmodifieddate
filters via batch endpoints, or use the IDs you already have to do batch reads, while Search cools off.
Hitting burst limit (190/10s):
Only non-search calls 429. You can still issue Search calls at 5/s. Useful for: continuing to identify deltas for queueing while in-flight updates drain, or refreshing a small set of records via Search even though your write pipeline is paused.
Hitting daily limit:
Everything stops. Search and non-search alike. Doesn't unblock until midnight in your portal's configured timezone — and remember this is shared across every private app in the portal, plus n8n flows, marketing tools, anything else hitting the API with that account.
So can one type of request block the other?
So can one type of request block the other?
Search → Burst:
No.
Saturating Search at 50 calls per 10s leaves your full 190/10s burst untouched.
Burst → Search:
No.
Saturating burst leaves Search's 5/s untouched.
Either → Daily:
Yes
, but only by contributing to the same daily counter. It's volume that kills you here, not the type.
In theory you can sustain ~50 search + ~190 other =
~240 calls per 10 seconds
indefinitely (until daily runs out), because the two buckets bill independently.
Implementation consequence
Implementation consequence
Your rate limiter needs to know which bucket a request hits before it acquires. Cleanest pattern:
Copy to clipboard
php
$limiter
->
acquire
(
'search'
,
$weight
=
1
)
;
// for search endpoints only
$limiter
->
acquire
(
'burst'
,
$weight
=
1
)
;
// for everything else
$limiter
->
acquire
(
'daily'
,
$weight
=
1
)
;
// every call, both kinds
In Redis: three separate keys, three separate Lua acquire scripts (or one script with a bucket parameter). A search call calls
acquire('search')
+
acquire('daily')
. A batch update calls
acquire('burst')
+
acquire('daily')
.
One subtle pitfall: when you backoff on a 429,
inspect
policyName
in the response body
to know which bucket actually fired. If you see
SECONDLY
from a search endpoint, you only need to delay search-bound jobs — burst-bound jobs in the queue can keep running. If you blanket-pause everything on any 429, you waste capacity on the bucket that's still healthy. Two queues (or two throttle keys) make this clean; one global pause is the lazy version.
The other subtlety: the burst response gives you
X-HubSpot-RateLimit-Remaining
to clamp local state against, but search doesn't return those headers. So your search counter is unverified — be slightly more conservative there (e.g., budget 4/s instead of 5) to absorb the unaccounted-for calls.
Copy
Give positive feedback
Give negative feedback
Retry
You said: Ok, so what will happen each time I make a request?
You said: Ok, so what will happen each time I make a request?
Ok, so what will happen each time I make a request? Let's say I have 100,000 requests to make that are instant. Do I need to increment each request based on the type? For example, if there is a search request, I need to increment both the search bucket and also the daily bucket. If it's a burst, then I can go to the daily and burst buckets. If I need to check if it can make a call, do I need to see both the daily and search, or burst, respectively? Isn't that too heavy for the infrastructure, adding additional load to each request?
13:44
Retry
Edit
Copy
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Claude responded: Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out.
Analyzed per-request overhead concerns and quantified Redis performance impact
Analyzed per-request overhead concerns and quantified Redis performance impact
Yes, your understanding is correct — every request must check and reserve from each bucket it applies to, atomically, before the call goes out. But the overhead is much smaller than it sounds, and importantly, it's nowhere near your bottleneck.
What "two buckets per request" actually costs
What "two buckets per request" actually costs
Each request makes
one round trip to Redis
— not two — because you fold both bucket checks into a single Lua script that runs atomically server-side:
Copy to clipboard
lua
-- KEYS[1] = burst bucket key (or search)
-- KEYS[2] = daily bucket key
-- ARGV[1] = now (ms) ARGV[2] = window_ms
-- ARGV[3] = bucket_max ARGV[4] = daily_max
-- ARGV[5] = request_id ARGV[6] = daily_ttl
-- Trim sliding window
redis
.
call
(
'ZREMRANGEBYSCORE'
,
KEYS
[
1
]
,
0
,
ARGV
[
1
]
-
ARGV
[
2
]
)
local
burst_used
=
redis
.
call
(
'ZCARD'
,
KEYS
[
1
]
)
local
daily_used
=
tonumber
(
redis
.
call
(
'GET'
,
KEYS
[
2
]
)
or
'0'
)
if
burst_used
>=...
|
Claude
|
Claude
|
NULL
|
4371
|
|
4577
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in...
|
Claude
|
Claude
|
NULL
|
4577
|
|
4578
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs...
|
Claude
|
Claude
|
NULL
|
4578
|
|
4579
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search...
|
Claude
|
Claude
|
NULL
|
4579
|
|
4580
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it
Redis. It's the only realistic option once you have multiple queue workers — DB-backed counters serialize too much, and in-process state can't coordinate across workers. Laravel already speaks Redis natively, and you get atomic
INCR
/
EXPIRE
plus Lua scripting for true CAS semantics.
Key layout I'd use:
Copy to clipboard
hubspot:rl:burst:{portalId}:{appId} ZSET (sliding 10s)
hubspot:rl:search:{portalId} ZSET (sliding 1s)
hubspot:rl:daily:{portalId} STRING + TTL to midnight TZ
hubspot:rl:meta:{portalId} HASH (last seen headers)
The two short-window buckets are sliding-window-log (Redis ZSET, score =
microtime
, member = unique request id). Lua script removes entries older than the window, counts remaining slots, and only adds the new one if there's room — all atomic. Fixed windows are simpler but allow 2× the limit at the boundary, which on a 5/s window is brutal.
The daily bucket is a plain
INCR
with TTL set to seconds-until-midnight in
HubSpot's account timezone
, not yours — Sofia is UTC+2/+3 but your portal might be set to US Eastern. Get this once and cache it.
How to read it
How to read it
Two-phase: optimistic pre-check, authoritative post-update.
Before a call, run the Lua acquire script. If it returns "denied," sleep until a slot frees up (the script can return ms-until-next-slot) or push the job back to the queue with a delay. Don't busy-loop.
After the call, parse
X-HubSpot-RateLimit-Remaining
/
-Max
/
-Interval-Milliseconds
and store them in
hubspot:rl:meta:{portalId}
. This is your reality check — if your local counter says 50 remaining but HubSpot's header says 5, you trust HubSpot and clamp your counter. This handles clock drift, missed accounting (e.g., crashed worker that took a token but never made the request), and other apps in the same account consuming the daily budget invisibly.
For search specifically, since headers don't come back, the local counter
is
the source of truth — meaning if you ever crash mid-flight, you've under-counted. Always release tokens on connection-level failure but
not
on 429 (you really did make that request).
How to work with multiple jobs
How to work with multiple jobs
The queue layer needs to enforce concurrency separately from the rate limiter. Both work together:
Concurrency cap
via
Queue::throttle()
or a Redis semaphore — limits how many sync workers run in parallel against HubSpot. Without this, you can have 50 workers all blocked waiting for tokens, which is wasteful and creates retry storms.
Per-tenant fairness
— if you sync many Jiminny customers into different HubSpot portals, each portal has its own bucket but you still want one slow portal not to starve others. Either separate queues per portal or a fair-share scheduler.
Priority lanes
— webhook-driven updates (user-visible latency) should outrank background batch syncs. Two queues:
hubspot-priority
and
hubspot-bulk
, with priority workers taking 70% of the burst budget and bulk taking 30% (enforce via separate sub-buckets if you really want hard separation, otherwise just pull from priority first).
Backoff on 429
— respect the
Retry-After
header. If absent, exponential with jitter (e.g.,
min(2^attempt * 250ms, 30s) ± 20%
). The jitter is non-negotiable; without it, simultaneous 429s retry in lockstep and you get thundering-herd 429s on retry.
How to work with paginated requests
How to work with paginated requests
The trap is treating "fetch all" as one logical operation. Each page is its own API call and competes for tokens with everything else.
Two practical rules:
Don't hold the worker idle while paginating.
If page N takes 500ms and page N+1 needs to wait 800ms for a token, you've burned 800ms of worker time doing nothing. Instead, fetch page N, dispatch the
processing
of page N as a separate job, and queue a "fetch page N+1" job with a delay equal to the wait time. Each page becomes its own atomic unit.
Always batch where HubSpot offers it.
POST /crm/v3/objects/{type}/batch/{read|update|create}
accepts up to 100 IDs per call. For your "patching IDs" flow this is the difference between 600 calls and 6.
Walkthrough: 600 opportunities
Walkthrough: 600 opportunities
Naive flow (one PATCH per deal): 600 calls. At 190/10s that's ~32s of API time, well under daily. You'd hit burst easily without throttling. Plus likely 1-3 search calls upfront and N association calls.
Sane flow:
Identify deltas
— if you can avoid Search at all, do. Use
lastmodifieddate
filter on a single search if you must, paginate at limit=200. For 600 deals that's 3 search calls @ 5/s = ~600ms naturally throttled.
Batch read
current state —
POST /crm/v3/objects/deals/batch/read
with 100 IDs per call → 6 calls. Burst weight 6.
Compute diff
in your code (no API).
Batch update
—
POST /crm/v3/objects/deals/batch/update
with 100 per call → 6 calls.
Associations
—
POST /crm/v4/associations/{from}/{to}/batch/create
if needed → another few batch calls.
Total: ~15-20 API calls for 600 deals. Burst budget consumed: 20/190 over ~5s. Daily impact: trivial.
Recognition: pre-check denies if
<weight>
slots aren't free; on 429 the response surfaces
policyName
(DAILY/SECONDLY) — log it, push the job back with
Retry-After
delay, increment a metric so you can alarm on sustained 429 rate.
Pitfalls & bottlenecks worth pre-empting
Pitfalls & bottlenecks worth pre-empting
Daily quota is shared across the whole portal
, including any n8n flows, other private apps, marketing automation calling APIs, etc. Budget for ~70-80% of the documented limit, not 100%. Add an internal per-app daily cap so a runaway sync can't starve other apps.
Search is uniquely fragile
: separate 5/s bucket, no headers to read, 10k-result cap per query. If you ever hit 10k+ deals matching a filter, partition by
hs_object_id
ranges or by
lastmodifieddate
windows.
Retry storms after HubSpot incidents
— always jitter, always cap total retries (e.g., 5 attempts, then dead-letter).
Webhook → sync → webhook loops
— when your update fires a HubSpot webhook that triggers another sync. Tag your own writes (e.g., a custom property
jy_last_sync_id
) and ignore webhooks where it just changed.
Token refresh
— OAuth refresh itself counts against burst. Cache the access token in Redis with TTL =
expires_in - 60s
, single-flight the refresh (only one worker refreshes; others wait on a lock).
Search latency for fresh writes
— newly created/updated objects don't appear in search instantly. Don't write-then-search; use returned IDs directly.
Clock skew
— Redis is authoritative. Don't use
time()
from each worker for window scoring; use
redis.call('TIME')
inside the Lua script.
Dead workers with held tokens
— sliding-window-log handles this naturally because tokens expire by score; token-bucket implementations need explicit release-on-crash logic.
The 5% error rule
counts every 429 toward your error budget, even successfully retried ones. If your pre-check is working well, 429s should be near zero — if they're not, your pre-check is wrong, not just slow.
Phantom contention with Laravel
RateLimited
middleware
: it's per-job-class by default, not per-portal. If your
SyncDealJob
and
UpdateActivityJob
are different classes both calling HubSpot, they don't share a Laravel-level limiter — you need a single
HubspotRateLimiter
service that everything routes through.
If you want, I can sketch the Lua script for the sliding-window acquire and the Laravel service wrapper around it.
Copy
Give positive feedback
Give negative feedback
Retry
You said: What will happen if there are two different types of rate limits?
You said: What will happen if there are two different types of rate limits?
What will happen if there are two different types of rate limits?
Search requests that have 5 requests per second
The other rate limit that has, let's say, 100 requests per 10 seconds How do these work together? Is there some conflict? Can I reach the limit with one request and block either as well, or are these separated? Can I still continue making search requests once I hit the normal requests limits?
13:40
Retry
Edit
Copy
Claude responded: They're independent buckets — with one shared bucket on top.
Claude responded: They're independent buckets — with one shared bucket on top.
Analyzed independent rate limit buckets and their practical interactions...
|
Claude
|
Claude
|
NULL
|
4580
|
|
4581
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
ClaudeFileEditVIeWWindowHelpHubSpot rate limit implementation strategythis is the headers I getWrite a message…Opus 4.7 Adaptive ~Hubspot rate limits reference - MDCopyUse timeZone to interpret resetsAt from the daily endpoint.Cheat sheet: profiling a new portal in PostmanThree calls, in order:1. GET /account-into/vs/details → portalinto + read durst neaders trom responseGET /account-info/v3/api-usage/daily/private-apps → daily limits (onlymeaningful for private apps)3. Skip search probing — the 5/sec is fixedError response shape"status""error"."message": "You have reached your secondly limit.","errorType" : "RATE_LIMIT","policyName" : "SECONDLY","...","requestiotnolncvname values.SECONDLY - search bucket (5/sec)• TEN_SECONDLY_ROLLING - burst bucket (110/10s for OAuth, 100-250/10s forprivate)• DAILY — private apps daily ceilingAlways inspect policyName on 429 to know which bucket fired and which queue toback off.Other operational guidelines• Error responses must stay under 5% of total daily requests for marketplacecertificationi• Polling endpoints: minimum interval 5 minutes.• Search query: max 3,000 chars, max 18 filters across 5 filter groups, max 10,000 totalresults per query.• Batch endpoints: up to 100 records per call (read create update).• Searchwho can edit, or upgrade to restore collaboration.GET ReadGET read call • GET Get Engage •$0Lukas/Stefka 121 • in 20mGET Read CopyGET https://api.tIteration run HSPOST search contaPOST search conta© Iteration run Se100% L2Thu 7 May 17:10:45UparadeIteration run SeNo environmentAvg. response time ©155 msP90 ©173 msP9S ©196 msP99 ©287 msError % ©0,00Failure % ©0,00Peak CPU % ©100.0 %Peak Memory % ©195 %Filter bv reauestsvAva. response262 ms 140 req/s25017•08•4617•08•4917-08-55)17•09•016,550108.48Error %0.00Falture %0.00Resp. time (Ava. ms)17:09:0717.09-1217.09-19- Requests/second - Ava. response - Error % - Virtual users ..• CPU % •• Memory %Min (ms)Max (ms)693287Globals Vault Tools 5000...
|
Claude
|
Claude
|
NULL
|
4581
|
|
4582
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Close
Share chat
Claude finished the response
You said: So just a solution for rate limit implementation.
You said: So just a solution for rate limit implementation.
So just a solution for rate limit implementation. The situation currently is that there are some daily and secondary limits for HubSpot. I would like to make sure I never reach a 429 error rate limit. The requests can come from any flow. It can be:
updating activity (engagement, meeting, call, note)
searching for a company or contact
updating deal
patching IDs
Review what the limit is at the moment in the HubSpot documentation and then think of the solution:
where to store it
how to read it
how to work with multiple jobs
how to work with paginated requests Let's consider a situation when there are 600 opportunities to sync. What would be the flow? How would the rate limit be recognized? How would it be handled? What are the potential issues? [API usage guidelines and limits - HubSpot docs](
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
https://developers.hubspot.com/docs/developer-tooling/platform/usage-guidelines
). Example of such a error Client error:
POST https://api.hubapi.com/crm/v3/objects/contact/search
resulted in a
429 Too Many Requests
response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT","correlationId":"019dffc4-4 (truncated...). Think carefully about the implementation and potential issue and bottlenecks.
Show more
10:42
Retry
Edit
Copy
Claude responded: Current HubSpot limits (Apr 2026)
Claude responded: Current HubSpot limits (Apr 2026)
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Synthesized HubSpot rate limit architecture with Redis storage and sliding window algorithms
Current HubSpot limits (Apr 2026)
Current HubSpot limits (Apr 2026)
For privately distributed apps (which is what Jiminny presumably uses with HubSpot), the limits are layered: a per-app burst window of 100/10s on Free/Starter, 190/10s on Pro/Enterprise, or 250/10s with the API Limit Increase add-on
, plus a per-account daily cap of 250k / 625k / 1M depending on tier — shared across all private apps in the account
. The burst window is per app; the daily quota is per portal.
hubspot
hubspot
hubspot
hubspot
The Search API is special: five requests per second per account, capped at 200 records per page, with a hard 10,000-result ceiling per query
. That's the limit the 429 in your example is hitting (
secondly limit
on
/crm/v3/objects/contact/search
). It's a separate bucket from the 190/10s, and critically, search responses do not include the
X-HubSpot-RateLimit-*
headers
— you can't read remaining capacity off the response, you have to track it yourself.
hubspot
hubspot
hubspot
hubspot
Non-search endpoints return
X-HubSpot-RateLimit-Remaining
,
-Max
, and
-Interval-Milliseconds
. The daily headers are not returned for OAuth-authenticated calls
, so for those you check the account-info endpoint or maintain your own counter. There's also a soft rule: errors should stay under 5% of total daily requests
— that's enforced for marketplace listing, but it's also a sane operational target.
hubspot
hubspot
hubspot
hubspot
So you have
four buckets
to track at minimum: app-burst (10s sliding), search-secondly (1s sliding), account-daily (24h fixed, midnight in HubSpot's TZ), and per-app daily share (your own budgeting on top of the account cap).
Where to store it
Where to store it...
|
Claude
|
Claude
|
NULL
|
4582
|
|
4583
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Edit
Copy
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value
App type
The API Limit Increase add-on does
not
raise the limit for public OAuth apps.
2. Search limit
2. Search limit
Cannot be queried.
No endpoint, no headers (search responses strip them).
Fixed constant:
5 requests per second per portal
. The 10,000-result ceiling per query and 200-records-per-page also apply.
Only confirmable by deliberately triggering a 429:
Copy to clipboard...
|
Claude
|
Claude
|
NULL
|
4583
|
|
4584
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Edit
Copy
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value...
|
Claude
|
Claude
|
NULL
|
4584
|
|
4585
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Edit
Copy
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
**P
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value
App type
The API Limit Increase add-on does
not
raise the limit for public OAuth apps.
2. Search limit
2. Search limit
Cannot be queried.
No endpoint, no headers (search responses strip them).
Fixed constant:
5 requests per second per portal
. The 10,000-result ceiling per query and 200-records-per-page also apply.
Only confirmable by deliberately triggering a 429:
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."
,
"errorType"
:
"RATE_LIMIT"
,
"policyName"
:
"SECONDLY"
}
policyName: "SECONDLY"
from a search endpoint = search bucket. Track this server-side; HubSpot won't help.
3. Daily limit
3. Daily limit
Public OAuth apps: no daily limit
Public OAuth apps:
no daily limit
Skip the daily bucket entirely. OAuth apps are constrained by burst (110/10s) only. Theoretical max sustained = 950,400 calls/day per portal.
Private apps: query the endpoint
Private apps: query the endpoint
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/api-usage/daily/private-apps
Authorization
:
Bearer {portal_access_token}
Returns:
Copy to clipboard
json
{
"results"
:
[
{
"name"
:
"private-apps-api-calls-daily"
,
"usageLimit"
:
1000000
,
"currentUsage"
:
47213
,
"collectedAt"
:
"2026-05-07T11:23:01.362Z"
,
"fetchStatus"
:
"SUCCESS"
,
"resetsAt"...
|
Claude
|
Claude
|
NULL
|
4585
|
|
4586
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Edit
Copy
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budg
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value
App type
The API Limit Increase add-on does
not
raise the limit for public OAuth apps.
2. Search limit
2. Search limit
Cannot be queried.
No endpoint, no headers (search responses strip them).
Fixed constant:
5 requests per second per portal
. The 10,000-result ceiling per query and 200-records-per-page also apply.
Only confirmable by deliberately triggering a 429:
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."
,
"errorType"
:
"RATE_LIMIT"
,
"policyName"
:
"SECONDLY"
}
policyName: "SECONDLY"
from a search endpoint = search bucket. Track this server-side; HubSpot won't help.
3. Daily limit
3. Daily limit
Public OAuth apps: no daily limit
Public OAuth apps:
no daily limit
Skip the daily bucket entirely. OAuth apps are constrained by burst (110/10s) only. Theoretical max sustained = 950,400 calls/day per portal.
Private apps: query the endpoint
Private apps: query the endpoint
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/api-usage/daily/private-apps
Authorization
:
Bearer {portal_access_token}
Returns:
Copy to clipboard
json
{
"results"
:
[
{
"name"
:
"private-apps-api-calls-daily"
,
"usageLimit"
:
1000000
,
"currentUsage"
:
47213
,
"collectedAt"
:
"2026-05-07T11:23:01.362Z"
,
"fetchStatus"
:
"SUCCESS"
,
"resetsAt"
:
"2026-05-08T04:00:00Z"
}
]
}
Field
Meaning
usageLimit
Daily ceiling (shared across ALL private apps in portal)
currentUsage
Today's consumption (private apps only — does not count OAuth calls)
resetsAt
Reset time in UTC, based on portal's configured timezone
Field
usageLimit
currentUsage
resetsAt
Meaning
Daily ceiling (shared across ALL private apps in portal)
Today's consumption (private apps only — does not count OAuth calls)
Reset time in UTC, based on portal's configured timezone
Field
Meaning
Daily limit by tier (private apps)
Daily limit by tier (private apps)
Tier
Daily limit
Free / Starter
250,000
Professional
625,000
Enterprise
1,000,000
Any tier + 1× API Limit Increase
+1,000,000
Any tier + 2× API Limit Increase
+2,000,000 (max)
Tier
Free / Starter
Professional
Enterprise
Any tier + 1× API Limit Increase
Any tier + 2× API Limit Increase
Daily limit
250,000
625,000
1,000,000
+1,000,000
+2,000,000 (max)
Tier
Daily limit
Portal context (timezone, tier)
Portal context (timezone, tier)
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Returns:
Copy to clipboard
json
{
"portalId"
:
123456
,
"accountType"
:
"STANDARD"
,
"timeZone"
:
"Europe/Sofia"
,
"utcOffset"
:
"+03:00"
,
"uiDomain"
:
"app.hubspot.com"
,
"dataHostingLocation"
:
"eu1"
}
Use
timeZone
to interpret
resetsAt
from the daily endpoint.
Cheat sheet: profiling a new portal in Postman
Cheat sheet: profiling a new portal in Postman
Three calls, in order:
GET /account-info/v3/details
→ portal info + read burst headers from response
GET /account-info/v3/api-usage/daily/private-apps
→ daily limits (only meaningful for private apps)
Skip search probing — the 5/sec is fixed
Error response shape
Error response shape
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."
,
"errorType"
:
"RATE_LIMIT"
,...
|
Claude
|
Claude
|
NULL
|
4586
|
|
4587
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
Scroll to bottom
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Settings
Press and hold to record
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes...
|
Claude
|
Claude
|
NULL
|
4587
|
|
4588
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
Scroll to bottom
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Settings
Press and hold to record
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call...
|
Claude
|
Claude
|
NULL
|
4588
|
|
4589
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(...
|
Claude
|
Claude
|
NULL
|
4589
|
|
4590
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the...
|
Claude
|
Claude
|
NULL
|
4590
|
|
4591
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''...
|
Claude
|
Claude
|
NULL
|
4591
|
|
4592
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
Scroll to bottom
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Settings
Press and hold to record
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning...
|
Claude
|
Claude
|
NULL
|
4592
|
|
4593
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId...
|
Claude
|
Claude
|
NULL
|
4593
|
|
4618
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Settings
Press and hold to record
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining...
|
Claude
|
Claude
|
NULL
|
4618
|
|
4695
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)...
|
Claude
|
Claude
|
NULL
|
4695
|
|
4696
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>...
|
Claude
|
Claude
|
NULL
|
4696
|
|
4697
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback...
|
Claude
|
Claude
|
NULL
|
4697
|
|
4698
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=...
|
Claude
|
Claude
|
NULL
|
4698
|
|
4699
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
ok now I dont see headers on suvccess either
ok now I dont see headers on suvccess either
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Send message
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header...
|
Claude
|
Claude
|
NULL
|
4699
|
|
4700
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}...
|
Claude
|
Claude
|
NULL
|
4700
|
|
4701
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
ok now I dont see headers on success either
ok now I dont see headers on success either
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Send message
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy...
|
Claude
|
Claude
|
NULL
|
4701
|
|
4702
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;...
|
Claude
|
Claude
|
NULL
|
4702
|
|
4703
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that....
|
Claude
|
Claude
|
NULL
|
4703
|
|
4706
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Send message
Claude is AI and can make mistakes. Please double-check responses....
|
Claude
|
Claude
|
NULL
|
4706
|
|
4707
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Send message
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type...
|
Claude
|
Claude
|
NULL
|
4707
|
|
4708
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Share chat
Claude finished the response
[2026-05-07 14:08:35] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:08:35 GMT"],"Content-Type":["application/json;charset=utf-8"],"Content-Length":["227"],"Connection":["keep-alive"],"CF-Ray":["9f80cc29fd66dc1a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02c4-d684-7f5d-be16-3d129d00c0a3\", cfr;desc=\"9f80cc2a06d23402-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02c4-d684-7f5d-be16-3d129d00c0a3"],"Set-Cookie":["__cf_bm=0LMCTstVmP5pyIYfLZ1Vgebevm4BnI_hv250XvZJDZI-1778162915-[IP_ADDRESS]-VEXAxU7TqgaJhUSJaNRDF5y59Eo7wOLd78Bm1nV_hNpBHZQPCrg.WMJL_LJy2qoR84rCgLXAlUPz4jkFWtD3fDjrRxypSlr4zAPvuPPaoNM; path=/; expires=Thu, 07-May-26 14:38:35 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=4wbdllfukF%2BA1EOwyTeqZCIqvY2KcW%2BCX5f%2BaZsnWkxc6ccKufGimFrCvj%2FnyWTDpsdCMXE0ngrpMA7WjiyvJDXtlDtN2YAhtK127%2FDtKe1JCyjgKsMQXBSMhBDyTC7c\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"d326aafa-339a-42c1-bf53-05ebd7f52782","trace_id":"19b29b52-6663-4853-8096-e32bf6618df7"}
Show more
17:10
Retry
Edit
Copy
Previous version
2 / 2
Next version
Claude responded: That confirms the diagnosis.
Claude responded: That confirms the diagnosis.
Confirmed absence of retry headers; policy-based fallback necessary
Confirmed absence of retry headers; policy-based fallback necessary
That confirms the diagnosis. Look at what's there and — more importantly — what isn't:
Missing from the 429 response:
❌
Retry-After
❌
X-HubSpot-RateLimit-Max
❌
X-HubSpot-RateLimit-Remaining
❌
X-HubSpot-RateLimit-Interval-Milliseconds
Present that's actually useful:
✅
x-hubspot-correlation-id
(for debugging / filing tickets with HubSpot)
So HubSpot is giving you essentially no telemetry on this 429. No retry hint, no remaining-budget signal. The fact that even the regular rate-limit headers are absent strongly suggests this was the
search
429 (the
/contact/search
one) — search responses always strip rate-limit headers, error or not.
What this means
What this means
Your
parseRetryAfter()
cannot rely on
Retry-After
from HubSpot.
The policy-based fallback is the actual primary path
, not a fallback. The header lookup is dead code that's there in case HubSpot ever changes — fine to keep, but understand it'll basically never fire.
So flip the framing of your function: the policy-based logic is the main behavior, header lookup is opportunistic.
Copy to clipboard
php
public
function
parseRetryAfter
(
Throwable
$e
)
:
int
{
// Opportunistic: HubSpot rarely sends Retry-After, but use it if present
$headers
=
$this
->
extractHeaders
(
$e
)
;
$retryAfter
=
$this
->
headerValue
(
$headers
,
'Retry-After'
)
;
if
(
is_numeric
(
$retryAfter
)
)
{
return
$this
->
withJitter
(
max
(
1
,
(
int
)
$retryAfter
)
)
;
}
// Primary path: derive from policyName in response body
$policy
=
$this
->
extractPolicy
(
$e
)
;
return
$this
->
withJitter
(
match
(
$policy
)
{
'SECONDLY'
=>
2
,
'TEN_SECONDLY_ROLLING'
=>
8
,
'DAILY'
=>
3600
,
default
=>
5
,
}
)
;
}
private
function
extractPolicy
(
Throwable
$e
)
:
?
string
{
$body
=
$this
->
extractBody
(
$e
)
;
$payload
=
json_decode
(
$body
,
true
)
?
:
[
]
;
return
strtoupper
(
$payload
[
'policyName'
]
??
''
)
?
:
null
;
}
private
function
withJitter
(
int
$seconds
)
:
int
{
// ±20% randomization to prevent thundering-herd retries
$jitter
=
(
int
)
(
$seconds
*
0.2
)
;
return
max
(
1
,
$seconds
+
random_int
(
-
$jitter
,
$jitter
)
)
;
}
Why those defaults
Why those defaults
SECONDLY
→ 2 seconds.
The window is 1 second, so 1.x seconds is enough in theory. 2 with jitter keeps you safely past the boundary even with clock skew.
TEN_SECONDLY_ROLLING
→ 8 seconds.
The window is 10 seconds
rolling
. If you only just barely tipped over (which is the common case if your pre-acquire is roughly correct), the oldest call exits the window in under 10 seconds. 8 + jitter is a reasonable expected value; on the unlucky end you'll still 429 once and back off again.
DAILY
→ 3600 (1 hour) or push to next-day queue.
Don't keep retrying every 10 seconds for the rest of the day — that just burns through your 5% error budget. Better to dead-letter the job until tomorrow morning. (Less relevant for you since OAuth has no daily, but worth handling for completeness.)
Jitter
is non-negotiable. Without it, all your workers that hit the same 429 retry in lockstep and re-create the same 429 wave.
Bonus: log the correlation ID
Bonus: log the correlation ID
You're throwing away a useful debugging signal. The
x-hubspot-correlation-id
from the response (and there's also one in HubSpot's response body for 429s) lets you ask HubSpot support "why did this specific call get rate limited" or correlate with their internal logs if you ever need to escalate. Capture it:
Copy to clipboard
php
$correlationId
=
$this
->
headerValue
(
$headers
,
'x-hubspot-correlation-id'
)
??
(
$payload
[
'correlationId'
]
??
null
)
;
$this
->
log
->
warning
(
'[Hubspot] 429 received'
,
[
'policy'
=>
$policy
,
'retry_after'
=>
$delaySeconds
,
'hubspot_correlation_id'
=>
$correlationId
,
'endpoint'
=>
$endpointForLogging
,
// pass this in
]
)
;
When a customer reports "my sync was slow today" and you can correlate to a flurry of 429s with HubSpot correlation IDs, the diagnosis path is much shorter.
So the final picture
So the final picture
For this codebase, given what HubSpot actually sends:
Pre-acquire from Redis bucket before every call
— this is your primary defense, since post-hoc info is sparse.
On 429, read
policyName
from the body
— the only reliable signal of which bucket fired.
Apply policy-specific backoff with jitter
—
Retry-After
is nice-to-have but rare in practice.
On success, capture
X-HubSpot-RateLimit-*
headers via Guzzle middleware
to clamp the local counter — these
are
present on 200 responses (just confirmed in your earlier Postman screenshot showing
Max=110
).
The asymmetry is the key insight: HubSpot tells you a lot when things are fine, almost nothing when they're not. Your limiter has to be smart enough to work with that.
Copy
Give positive feedback
Give negative feedback
Retry
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I somhow request
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I somhow request
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Send message
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining...
|
Claude
|
Claude
|
NULL
|
4708
|
|
4709
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
You said: ok now I don't see headers on success either [2026-05-07 14:21:15] local.
You said: ok now I don't see headers on success either [2026-05-07 14:21:15] local.
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I somhow request heders in request
Show more
17:23
Edit
Copy
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value
App type
The API Limit Increase add-on does
not
raise the limit for public OAuth apps.
2. Search limit
2. Search limit
Cannot be queried.
No endpoint, no headers (search responses strip them).
Fixed constant:
5 requests per second per portal
. The 10,000-result ceiling per query and 200-records-per-page also apply.
Only confirmable by deliberately triggering a 429:
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."
,
"errorType"
:
"RATE_LIMIT"
,
"policyName"
:
"SECONDLY"
}
policyName: "SECONDLY"
from a search endpoint = search bucket. Track this server-side; HubSpot won't help.
3. Daily limit
3. Daily limit
Public OAuth apps: no daily limit
Public OAuth apps:
no daily limit
Skip the daily bucket entirely. OAuth apps are constrained by burst (110/10s) only. Theoretical max sustained = 950,400 calls/day per portal.
Private apps: query the endpoint
Private apps: query the endpoint
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/api-usage/daily/private-apps
Authorization
:
Bearer {portal_access_token}
Returns:
Copy to clipboard
json
{
"results"
:
[
{
"name"
:
"private-apps-api-calls-daily"
,
"usageLimit"
:
1000000
,
"currentUsage"
:
47213
,
"collectedAt"
:
"2026-05-07T11:23:01.362Z"
,
"fetchStatus"
:
"SUCCESS"
,
"resetsAt"
:
"2026-05-08T04:00:00Z"
}
]
}
Field
Meaning
usageLimit
Daily ceiling (shared across ALL private apps in portal)
currentUsage
Today's consumption (private apps only — does not count OAuth calls)
resetsAt
Reset time in UTC, based on portal's configured timezone
Field
usageLimit
currentUsage
resetsAt
Meaning
Daily ceiling (shared across ALL private apps in portal)
Today's consumption (private apps only — does not count OAuth calls)
Reset time in UTC, based on portal's configured timezone
Field
Meaning
Daily limit by tier (private apps)
Daily limit by tier (private apps)
Tier
Daily limit
Free / Starter
250,000
Professional
625,000
Enterprise
1,000,000
Any tier + 1× API Limit Increase
+1,000,000
Any tier + 2× API Limit Increase
+2,000,000 (max)
Tier
Free / Starter
Professional
Enterprise
Any tier + 1× API Limit Increase
Any tier + 2× API Limit Increase
Daily limit
250,000
625,000
1,000,000
+1,000,000
+2,000,000 (max)
Tier
Daily limit
Portal context (timezone, tier)
Portal context (timezone, tier)
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Returns:
Copy to clipboard
json
{
"portalId"
:
123456
,
"accountType"
:
"STANDARD"
,
"timeZone"
:
"Europe/Sofia"
,
"utcOffset"
:
"+03:00"
,
"uiDomain"
:
"app.hubspot.com"
,
"dataHostingLocation"
:
"eu1"
}
Use
timeZone
to interpret
resetsAt
from the daily endpoint.
Cheat sheet: profiling a new portal in Postman
Cheat sheet: profiling a new portal in Postman
Three calls, in order:
GET /account-info/v3/details
→ portal info + read burst headers from response
GET /account-info/v3/api-usage/daily/private-apps
→ daily limits (only meaningful for private apps)
Skip search probing — the 5/sec is fixed
Error response shape
Error response shape
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."...
|
Claude
|
Claude
|
NULL
|
4709
|
|
4710
|
Skip to content
Skip to content
Click to collapse
Skip to content
Skip to content
Click to collapse
⌘B
Drag to resize
Open sidebar
Chat
Cowork
Code
New chat ⌘N
New chat
⌘N
Projects
Artifacts
Customize
Pinned
Bulgarian citizenship application process for EU residents
More options for Bulgarian citizenship application process for EU residents
Dawarich location tracking project
More options for Dawarich location tracking project
Recents
View all
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Screenpipe retention policy code location
More options for Screenpipe retention policy code location
Viewing retention policy in screenpipe
More options for Viewing retention policy in screenpipe
Clean shot x video recording termination issue
More options for Clean shot x video recording termination issue
HubSpot rate limit handling with executeRequest
More options for HubSpot rate limit handling with executeRequest
Untitled
More options
💬 Screen pipe. Is there ability…
More options for 💬 Screen pipe. Is there ability…
SMB mount access inconsistency between Finder and iTerm
More options for SMB mount access inconsistency between Finder and iTerm
💬 What is the best switch I can…
More options for 💬 What is the best switch I can…
Permission denied on screenpipe volume
More options for Permission denied on screenpipe volume
Screenpipe sync database attachment error
More options for Screenpipe sync database attachment error
Last swimming outing with Dani
More options for Last swimming outing with Dani
Definition of incarcerated
More options for Definition of incarcerated
Chromecast remote volume buttons not working
More options for Chromecast remote volume buttons not working
Salesforce API errors with Organization and FieldDefinition queries
More options for Salesforce API errors with Organization and FieldDefinition queries
Daily activity summary from screenpipe data
More options for Daily activity summary from screenpipe data
MacBook unexpected restarts and kanji screen
More options for MacBook unexpected restarts and kanji screen
Security patch review and testing guidance
More options for Security patch review and testing guidance
Food calorie values reference
More options for Food calorie values reference
Tracking location history from last week
More options for Tracking location history from last week
Lukas Pro
Get apps and extensions
HubSpot rate limit implementation strategy, rename chat
HubSpot rate limit implementation strategy
More options for HubSpot rate limit implementation strategy
Claude is responding
You said: ok now I don't see headers on success either [2026-05-07 14:21:15] local.
You said: ok now I don't see headers on success either [2026-05-07 14:21:15] local.
ok now I don't see headers on success either [2026-05-07 14:21:15] local.INFO: [Hubspot] DEBUG Getting headers {"headers":{"Date":["Thu, 07 May 2026 14:21:15 GMT"],"Content-Type":["application/json;charset=utf-8"],"Transfer-Encoding":["chunked"],"Connection":["keep-alive"],"CF-Ray":["9f80deb8db60dc3a-SOF"],"CF-Cache-Status":["DYNAMIC"],"Strict-Transport-Security":["max-age=31536000; includeSubDomains; preload"],"Vary":["origin, accept-encoding"],"access-control-allow-credentials":["false"],"server-timing":["hcid;desc=\"019e02d0-6fd8-7812-bdba-885b7ccb3ee3\", cfr;desc=\"9f80deb8e7c6dc3a-IAD\""],"x-content-type-options":["nosniff"],"x-hubspot-correlation-id":["019e02d0-6fd8-7812-bdba-885b7ccb3ee3"],"Set-Cookie":["__cf_bm=SIUrtdQgXVrik50pdqF6hZVYKhzTnQBidvMabeCtm0Y-1778163675-[IP_ADDRESS]-rI.ZggtDKxTge5zr8_2gbBfWMQQ.ufZEXDZyHz2mBUFdzdo2gTHEsOkXMSEShjK0hGYxNhUGM1ZoBpX7BcFZcHEjA7Cs_.SMUhUnd2nYjko; path=/; expires=Thu, 07-May-26 14:51:15 GMT; domain=.hubapi.com; HttpOnly; Secure; SameSite=None"],"Report-To":["{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v4?s=NYAlsVTP0fYm32qrSDjxYE4sd2RWRqiSp3wHsmdEgZlzoYdxI%2BIxVpHmsKn3O%2BKVA3mFIJ2m7YRECDGSM%2BW2IYTzo6FM4%2BdUIjURO8srzKSvJgZ%2BQ6R79arKQw3uHLlX\"}],\"group\":\"cf-nel\",\"max_age\":604800}"],"NEL":["{\"success_fraction\":0.01,\"report_to\":\"cf-nel\",\"max_age\":604800}"],"Server":["cloudflare"]}} {"correlation_id":"95236535-ec98-4541-b92a-adfa73b69eab","trace_id":"c7ab8365-903f-46d4-9403-0e5b551e3545"}. But in postman it is there should I somhow request heders in request
Show more
17:23
Edit
Copy
Write a message…
Write a message…
Add files, connectors, and more
Model: Opus 4.7 Adaptive
Opus 4.7
Adaptive
Stop response
Claude is AI and can make mistakes. Please double-check responses.
Claude is AI and can make mistakes. Please double-check responses.
Preview
Code
Hubspot rate limits reference · MD
Hubspot rate limits reference
·
MD
Copy
Go back
HubSpot Rate Limit Reference
HubSpot Rate Limit Reference
Quick reference for checking what rate limits apply to a portal.
Three buckets, three discovery methods
Three buckets, three discovery methods
Bucket
How to check
Notes
Burst
Response headers on any non-search call
Auto-discoverable per portal
Search
Not queryable
Fixed at 5 req/sec, only confirmable via 429
Daily
/account-info/v3/api-usage/daily/private-apps
Private apps only — OAuth has no daily limit
Bucket
Burst
Search
Daily
How to check
Response headers on any non-search call
Not queryable
/account-info/v3/api-usage/daily/private-apps
Notes
Auto-discoverable per portal
Fixed at 5 req/sec, only confirmable via 429
Private apps only — OAuth has no daily limit
Bucket
How to check
Notes
1. Burst limit
1. Burst limit
Make any non-search call and read the
response headers
(not body).
Copy to clipboard
http
GET https://api.hubapi.com/account-info/v3/details
Authorization
:
Bearer {portal_access_token}
Headers in response:
Header
Meaning
X-HubSpot-RateLimit-Max
Burst ceiling
X-HubSpot-RateLimit-Remaining
Calls left in current window
X-HubSpot-RateLimit-Interval-Milliseconds
Window size, always
10000
X-HubSpot-RateLimit-Secondly
Deprecated, ignore
X-HubSpot-RateLimit-Secondly-Remaining
Deprecated, ignore
Header
X-HubSpot-RateLimit-Max
X-HubSpot-RateLimit-Remaining
X-HubSpot-RateLimit-Interval-Milliseconds
X-HubSpot-RateLimit-Secondly
X-HubSpot-RateLimit-Secondly-Remaining
Meaning
Burst ceiling
Calls left in current window
Window size, always
10000
Deprecated, ignore
Deprecated, ignore
Header
Meaning
Inferring app type from Max
Inferring app type from
Max
Max
value
App type
100
Free/Starter private app
110
Public OAuth app (marketplace)
190
Pro/Enterprise private app
250
Private app + API Limit Increase add-on
Max
value
100
110
190
250
App type
Free/Starter private app
Public OAuth app (marketplace)
Pro/Enterprise private app
Private app + API Limit Increase add-on
Max
value
App type
The API Limit Increase add-on does
not
raise the limit for public OAuth apps.
2. Search limit
2. Search limit
Cannot be queried.
No endpoint, no headers (search responses strip them).
Fixed constant:
5 requests per second per portal
. The 10,000-result ceiling per query and 200-records-per-page also apply.
Only confirmable by deliberately triggering a 429:
Copy to clipboard
json
{
"status"
:
"error"
,
"message"
:
"You have reached your secondly limit."
,
"errorType"
:
"RATE_LIMIT"
,
"policyName"
:
"SECONDLY"
}
policyName: "SECONDLY"
from a search endpoint = search bucket. Track this server-side; HubSpot won't help.
3. Daily limit
3. Daily limit
Public OAuth apps: no daily limit
Public OAuth apps:
no daily limit
Skip the daily bucket entirely. OAuth apps are constrained by burst (110/10s) only. Theoretical max sustained = 950,400 calls/day per portal.
Private apps: query the endpoint
Private apps: query the endpoint...
|
Claude
|
Claude
|
NULL
|
4710
|