# Hootsuite API 2026: OAuth, Rate Limits, Analytics, Webhooks and MCP > How the Hootsuite API works in 2026: OAuth grant types, 20 requests a second, what the Publishing and Analytics APIs cannot do, webhooks and four MCP servers. _Source: https://professionalstoolkit.com/articles/hootsuite-api — The Professional's Toolkit · updated October 2026_ --- **100,000** — API calls a day (daily quota), with a ceiling of 20 requests a second and HTTP 429 beyond. - **20 req/s** — per-second limit, 429 beyond - **4 MCP servers** — Perch, Nest, Lumen, Parliament - **2-4 weeks** — first response to a public App Directory submission ## What the Hootsuite developer platform actually covers Hootsuite gives developers more than one door into the product, and it helps to know which one you need before you register anything. The core is a REST API served only over HTTPS at platform.hootsuite.com, speaking JSON and secured with OAuth 2.0. It works on the same data as the dashboard, so a post scheduled through the API shows up in the Planner like any other. Around that core sit four external APIs (Publishing, Inbox or CRM, Amplify and Analytics), webhooks, SCIM provisioning for users and teams, and an iFrame SDK for apps that live inside the dashboard. There are also four MCP servers for AI assistants. The API itself costs nothing. The REST endpoints and the SDK are free for anyone with approved developer access, but every call acts on a Hootsuite account, and Hootsuite has no free plan. Several features behind them are also tied to paid plans or add-ons, which we flag as we go. The documentation is unusually friendly to machines as well: developer.hootsuite.com publishes an llms.txt index of the whole site and Markdown versions of its pages, so you can point a coding assistant at the docs instead of pasting fragments. Hootsuite also pitches hard to app builders, which explains why so much of the documentation covers embedded apps. > ⚠ **Authorization codes work once:** Reusing an authorization code revokes every token from the first exchange, and each refresh token also works a single time. Store the new refresh token after every renewal. ## Getting a developer account and an app Everything starts with a developer account, and that account must be approved. You request access with a detailed description of what you intend to build or how you plan to use the REST API, and Hootsuite notifies you by email once it says yes. **The first visit of any member account to the Dev Portal triggers a developer review**, so do not leave this step for the week of a deadline. After approval, registering an app generates the REST API keys automatically, and you can manage redirect URIs yourself in the portal. They must use HTTPS or point to localhost, and you can register several for different environments. Review of the app itself depends on who will use it. An app that is not listed publicly in the App Directory needs no review, and a developer can install and use their own app freely. That makes single-customer integrations simple: create the app under the same member account that will call the API. Apps meant for the public directory go through a submission with listing copy and screenshots, and the App Directory team does an initial review and responds within 2-4 weeks. One quirk to remember. Once an app is In Review or Launched, changing its redirect URIs requires a message to Developer Support. > 💡 **Start with a private member app:** Once your developer access is approved, apps that are not listed in the App Directory need no app review, and you can install your own app freely. Build single-customer integrations under the member account that will call the API. ## Authentication: four grant types, two kinds of app The token endpoint supports four grant types: authorization_code, refresh_token, member_app and organization_app. Client credentials must travel in an HTTP Basic authentication header, because sending them in the request body is not supported. The authorization code flow is the familiar one. Your app sends the user to the Hootsuite login page, receives a code and swaps it for an access token. Codes expire after 10 minutes and **can be used only once**; reusing a code revokes every token granted by the first exchange. Refresh tokens never expire, but each one also works a single time, so store the new refresh token after every renewal or your integration will lock itself out. An API user never gets more power than in the dashboard. Tokens carry the same permissions the member has in the web app, and the permissions matrix spells it out: scheduling a message needs Limited or higher on the social profile, deleting one needs Editor or higher, and member and organization endpoints need Admin or higher. Token lifetimes in the examples vary by flow. The member_app token expires in one hour, while the organization token example shows 30 days. Keep the Client Secret on the server. The docs warn it must never appear in client-side code or a public repository. ### Member apps for one customer A member app uses the member_app grant to reach the social accounts of any user who installed it. For a company wiring Hootsuite into its own data warehouse, this is the simplest route the docs describe: the member installs the app, and the integration requests tokens for that member with the analytics:read scope when it needs reporting data. Hootsuite recommends a service member account for this kind of extract work, one that is not tied to a real person, so the integration does not break when an employee leaves. The catch is the scope itself. analytics:read is only for members with the Advanced Analytics add-on. ### Organization apps for full control An organization app is the heavier option. Once Hootsuite links it, the app can create tokens at any time and has full access to every social account shared to the organization, which is why the setup is gated. You open a ticket with the Development Support Team, and the setup needs a member with Admin or Super Admin permission who is not the organization owner and is not a paying seat. The default offline scope covers publishing only; adding analytics:read grants analytics as well. Hootsuite strongly recommends an org app for all inbox integrations. ## Scheduling posts and uploading media Publishing runs through one endpoint, POST /v1/messages. A single request can target one or more social profiles by ID, and the API answers with one message ID per profile, because each scheduled message belongs to exactly one profile. Times must be UTC in ISO-8601 format ending in Z; any other timezone is rejected. A message must be scheduled at least 5 minutes in the future, and one sent without a fixed time gets the soonest possible slot. **Pinterest is the exception to bundling**: a Pinterest post cannot share a request with any other social profile, so your code needs a separate call for it. Media takes three steps. You request an upload URL, upload the file to it with a Content-Length that exactly matches the size you declared, then wait until the media reaches the READY state before attaching it. Skipping that wait can trigger the vague 5000 unknown error. The API accepts mp4 and mov video and gif, jpeg, jpg and png images, generates thumbnails itself and does not support custom video thumbnails. Videos must be scheduled at least 15 minutes ahead, and an hour is recommended for large files or approval workflows. Hootsuite deletes uploaded media 90 days after it is used in a message. One change from October 2026 matters for locked-down networks. From October 13, 2026, media URLs returned by POST /v1/media use the hostname media-assets.hootsuite.com instead of the old S3 address, as delivery moves to CloudFront. Integrations with a domain allowlist should add the new hostname and keep the old one, since presigned S3 links issued earlier keep working until they expire. ## The limits that shape every integration The REST API combines a daily quota with a per-second ceiling: **20 requests a second and 100,000 calls a day**, with HTTP 429 returned when you exceed either one [1]. The allowance is split equally across cluster nodes, so the remaining-request headers you read describe one node, not your whole budget. Build backoff into the client from day one. Responses can also fail partially, returning a data object and an errors array together, so a 200 status does not prove that every profile in a request succeeded. Network coverage is the bigger constraint. The Publishing API does not support TikTok, YouTube or Bluesky [2], even though the dashboard schedules to all three. Instagram Business is supported; one older FAQ says otherwise, but the REST API FAQ marks that error as deprecated since 2024. Data export has its own gaps. X permits only platform IDs to leave, and LinkedIn does not allow its social media and ad data to be exported at all. The Ow.ly link-shortening API is reserved for Enterprise customers and requested through a customer success manager. > ⚠ **No TikTok, YouTube or Bluesky publishing:** The Publishing API cannot post to these three networks, even though the dashboard can. Short-video teams will still schedule those posts by hand. ## The Analytics API, and the add-on it needs The Analytics API arrived in April 2026. It returns published posts with cumulative lifetime metrics and daily metrics for each social profile, with network-provided breakdowns such as city, country, age, gender and hour for Facebook Pages, Instagram Business, Threads and TikTok Business. Metrics also cover Pinterest and YouTube. The access rule is strict. **Calling it for a user requires that user to have bought the Advanced Analytics add-on** [3], and Advanced Analytics is a paid add-on available on Enterprise. Your app must also hold and request the analytics:read scope. For a team on a self-serve plan, the reporting endpoints are effectively closed. The call limits are modest, so plan batching early. Each request accepts at most 10 social profile IDs and returns at most 100 results, with cursor pagination for the rest. Data reaches back two years at most, and a lastModified filter may start no more than 30 days back. Paid analytics follows similar rules, with up to 10 ad accounts per request and only Facebook and Twitter ad accounts supported. Watch the Facebook numbers too. Since June 3, 2026, Facebook impressions and reach metrics are deprecated, though older history still returns. ## Webhooks, inbox hooks and user provisioning Message webhooks fire on every state change of a scheduled post, which saves you from polling. The states include SCHEDULED, PENDING_APPROVAL, APPROVED, SUBMITTED for videos still uploading, SENT, SEND_FAILED_PERMANENTLY, DELETED and REJECTED. App webhooks report INSTALLED and UNINSTALLED events for member and organization apps, and an uninstall callback lets you clean up a departing user's data. If your callback URL fails often enough to be disabled, a successful reply to a ping event switches it back on. The inbox has a separate set of CRM webhooks. The developer docs say they require an Advanced plan, while the packaged Salesforce and Zendesk links need Enterprise with Advanced Inbox, so confirm with sales which plan your inbox integration needs. They also require an Org App, which Hootsuite links through a support ticket. A Lookup webhook fires when an agent opens a conversation and fetches contact attributes from your CRM; a Writeback webhook sends conversation details, tags and notes back. The receiving endpoint has hard rules. It must resolve to a public IP on port 80, 8080, 443 or 8443, answer within 10 seconds with a 2xx status and return no more than 32KB. Requests are signed with a SHA-512 HMAC over the timestamp and body using a shared secret. Beyond that, a virtual agent API connects any bot platform, and proactive messaging sends WhatsApp and SMS at up to 60 messages a minute per organization. ### Members, teams and SCIM 2.0 Administration is scriptable as well. The REST API retrieves members, their organizations, teams and permissions, adds members to teams and removes them from an organization, which needs Admin rights. For identity providers there is SCIM 2.0: you can create, replace and modify users and groups, where a group maps to a Hootsuite team. Deprovisioning is covered too, which is what security teams care about most. Single sign-on through SAML 2.0 is Enterprise-only. ## Building inside the dashboard with the iFrame SDK Some integrations belong inside Hootsuite rather than beside it. The iFrame SDK, version 4.1 since November 2, 2021, lets you build stream apps that show messages from other networks or sites, plugins that send a stream message to your service, content source apps, media library apps for asset systems and plan apps that bring planned posts into the Planner. You host the app; Hootsuite supplies HTML and CSS templates. Earlier SDK versions are no longer supported, and in 4.1 only the V2 methods can open Composer and attach files or media, while videos must go through the REST upload. Hootsuite runs a testing checklist on every submitted app, and the bar is specific. Apps must follow WCAG 2.1 accessibility guidelines, be fully HTTPS compliant, load in under 2 seconds per action and support recent versions of Chrome, Firefox and Safari. The directory already lists more than 100 apps, and a paid apps program lets developers charge for theirs, billed to customers monthly after a 30-day app trial. ## The four MCP servers, and what each refuses to do Hootsuite's MCP servers connect AI assistants to the product without code. Claude and ChatGPT connect through pre-built connectors, while Gemini and Microsoft Copilot users must pass the server URL to an IT administrator. Signing in with your Hootsuite workspace once is enough, and permissions stay tied to your account. Each server works best for reading and preparing, and each has a limit: the help article spells out the Nest and Lumen ones [4], while the developer reference sets out the Perch and Parliament behavior. | Server | What it does | Where it stops | | --- | --- | --- | | Perch | 16 tools: drafts, media uploads up to 1 GB, analytics for the last 25 months | Per the developer reference, cannot publish or schedule (the help article says it can); drafts wait for a person | | Nest | 17 tools: triage, status, notes, topics, assignment | Cannot send replies to customers | | Lumen | Mentions, sentiment, trends, influencers | Read-only; needs a Talkwalker licence | | Parliament | 9 tools: advocacy posts and share plans | Shares publish at once when no schedule is set | The table hides one disagreement worth knowing about. The help article and the marketing page describe Perch publishing posts, but the developer reference says the Perch server cannot publish or schedule, and drafts with a date sit grey in the Planner and never go out on their own. Build for the stricter behavior. Parliament is the opposite risk, because an unscheduled share goes live immediately with no draft, review or undo. Sessions are stateless, and data from X, LinkedIn, Reddit, Snapchat and YouTube is excluded while a connector is active. The commercial terms are thin. Perch and Nest work only on plans that include MCP connector access, and Hootsuite does not publish which plans those are. The MCP terms provide the servers as is, with no warranty or service level commitment, and let Hootsuite change rate limits without notice and add fees later. Customers must also make sure no client uses the servers for bulk extraction or for training outside models. For how these connectors fit with Wisdom and the rest of the AI features, read our [Hootsuite AI guide](/articles/hootsuite-ai). > 💡 **Treat Perch MCP as a drafting tool:** The developer reference says the Perch server cannot publish or schedule, so drafts wait for a person in the Planner. Plan your AI workflow around review, not automatic posting. ## Getting help, and where to start Developer support is thinner than the documentation. The support page offers an email address and warns that replies may be delayed, while the platform overview routes API and SDK questions to a community portal shared with Talkwalker. Technical meetings need a customer success manager and cannot be booked through a ticket. In practice, the docs are your main support channel. Read the FAQ pages closely, since they record changes that older guides still contradict. A sensible first project is small. Request developer access, create a private member app, schedule one text post to a test profile, then add webhooks for its SENT state before you touch media or analytics. If what you really need is a few automations rather than code, the Zapier integration can publish a post whenever a spreadsheet gains a row, and the dashboard may cover the rest. If the API is part of a wider purchase decision, our [Hootsuite buyer's checklist](/articles/hootsuite-buyers-checklist) puts it next to pricing, support and compliance questions. ## FAQ **Is the Hootsuite API free?** Yes. The REST endpoints and the SDK are free for anyone with approved developer access, but every call acts on a Hootsuite account, and Hootsuite has no free plan. Some features also need paid add-ons, such as the Advanced Analytics add-on for the Analytics API. **What are the Hootsuite API rate limits?** 20 requests a second and 100,000 calls a day. Going over either limit returns HTTP 429. **Can the Hootsuite API post to TikTok or YouTube?** No. The Publishing API does not support TikTok, YouTube or Bluesky. Instagram Business scheduling has been supported since 2024. **Does Hootsuite have an MCP server?** It has four: Perch, Nest, Lumen and Parliament. Claude and ChatGPT connect through pre-built connectors, while Gemini and Copilot need an IT administrator to add the server URL. Perch and Nest need a plan that includes MCP connector access, which Hootsuite does not list, and Lumen also needs a Talkwalker licence. **Which Hootsuite plan do I need for the Analytics API?** The user must have the Advanced Analytics add-on, a paid add-on available on Enterprise, and the app must request the analytics:read scope. **How long until Hootsuite responds to an App Directory submission?** The App Directory team does an initial review and responds within 2-4 weeks. Apps that are not listed publicly need no review. ## The bottom line The Hootsuite API is solid, well documented and free to use, but it reflects the plans behind it. Publishing and message webhooks are open to any approved developer, within 20 requests a second and 100,000 calls a day, while member and team calls need Admin rights and Hootsuite does not say which plans include SCIM. Analytics needs the Advanced Analytics add-on, inbox CRM hooks need an Org App and, per the developer docs, an Advanced plan (confirm with sales), and TikTok, YouTube and Bluesky are out of reach for the Publishing API. The MCP servers are useful for drafting and triage, not for hands-off publishing. Check those gates against your use case first, then start with a private member app and one scheduled post. ## Sources [1] Hootsuite Developers: docs / api rate limits — https://developer.hootsuite.com/docs/api-rate-limits (2026-10) [2] Hootsuite Developers: docs / api overview — https://developer.hootsuite.com/docs/api-overview (2026-10) [3] Hootsuite Developers: docs / analytics overview — https://developer.hootsuite.com/docs/analytics-overview (2026-10) [4] Hootsuite Help: about mcps — https://help.hootsuite.com/s/article/about-mcps?language=en_US (2026-10) [5] Hootsuite plans page — https://www.hootsuite.com/plans [6] Hootsuite Help Center — https://help.hootsuite.com/s/article/billing-FAQ?language=en_US [7] Hootsuite What's New — https://www.hootsuite.com/whats-new/social-os [8] G2, Hootsuite reviews — https://www.g2.com/products/hootsuite/reviews