Pipedrive OAuth vs API token: limits, scopes, which to use

Use OAuth for anything other people will install or that has to keep running, and an API token for a quick script of your own. Both spend the same daily token budget, which belongs to the company. OAuth gets 4 times the burst limit, lets you ask for only the scopes you need, and keeps working if an admin stops users from accessing their own API token. It's also the only method the Pipedrive Marketplace accepts. An API token is simpler: copy it from your settings and send it in a header, with no app to create and no refresh to handle.

Measured in a Pipedrive sandbox, October 2026. Pipedrive's docs read on November 2, 2026. Last checked: November 2, 2026. What we couldn't verify.

API token vs OAuth in one table

Sources: authentication (updated January 5, 2026), rate limiting (September 17, 2026), OAuth authorization (June 9, 2026), scopes (May 4, 2026), API access for users (September 3, 2026) and app approval (November 12, 2025).

Pipedrive's authentication page doesn't recommend one method over the other. The only hard rule is for the Marketplace: apps must use OAuth and must not collect or store the user's API token.

Burst limits by plan

The burst limit is how many requests you can send in a rolling 2-second window. Go over it and you get a 429 for a moment. This is where the two methods differ.

Search is 10 requests per 2 seconds on every plan, with either method (rate limiting, September 17, 2026).

What we measured. On October 14, 2026, we called the same Pipedrive sandbox account with an API token and with a private OAuth app. Pipedrive returned a burst limit of 20 with the token and 80 with OAuth, in the x-ratelimit-limit header. The daily limit header said 150,000 with both. We read these limits from the headers; we didn't send 80 requests in 2 seconds to trigger the 429.

Those numbers match the Lite row. Pipedrive doesn't say which plan a developer sandbox mirrors, so we can't confirm the sandbox is on Lite.

The burst limit matters when you sync, import or backfill. At 20 per 2 seconds, reading 10,000 records one by one takes over 16 minutes at full speed, by our math. At 80 it takes about 4. Listing with v2 endpoints, up to 500 per page, cuts this far more than switching methods does.

The daily budget is the same

OAuth doesn't give you more daily budget. The formula is 30,000 tokens × plan multiplier × seats, plus top-ups, and it's "shared among all users within that account" (rate limiting). API token and OAuth traffic draw from the same pool. In our sandbox both methods reported the same 150,000. Plan sizes, what each call costs and when the budget resets (07:00 UTC when we measured it on October 16, 2026) are in how big your budget is and when the limit resets.

So switching Zapier or your script to OAuth won't stop a daily 429. It only helps with bursts.

The 403 that only hits API tokens

If a client keeps sending a lot of requests after it gets 429 errors, Pipedrive may answer with a 403 from Cloudflare instead. The rate limiting page says: "Only the high volume traffic coming from api_token integrations will be blocked" (rate limiting). With OAuth you still get 429 errors, but the docs don't describe this block. Either way, back off when you see a 429.

OAuth scopes

Pipedrive lists 30 scopes (scopes and permissions, May 4, 2026). The ones most integrations use:

The rest cover projects, goals, recents, and Marketplace features such as phone, video calls and messengers.

Three things to know:

• All or nothing. The user accepts every scope you ask for, or none. There's no checkbox per scope.
• admin isn't enforced at install. The Marketplace lets non-admins install an app that asks for admin. Your app has to handle that.
• Ask for the minimum. Marketplace review asks for only the scopes you need and a video showing how you use them.

What we measured. Merging persons, organizations, deals and leads, and undoing person, organization and deal merges, worked in our sandbox with 9 scopes: deals:full activities:full contacts:full leads:full users:read search:read webhooks:full deal-fields:full contact-fields:full. No Mail, Products or Admin.

How to set up each one

API token

1. In Pipedrive, go to Settings > Personal preferences > API and copy the token (find your API token, September 3, 2026).
2. Send it in the x-api-token header, as Pipedrive's authentication page shows. Many third-party guides still put ?api_token= in the URL, where it ends up in logs.
3. Store it like a password. Each user has one active token, and changing it breaks every integration that uses it.

If you don't see the API page, your admin may have turned off Access their own API token in the user's permission set.

OAuth app

1. Open the Developer Hub from a developer sandbox account and create an app (Developer Hub, June 9, 2026). The sandbox is deleted if you don't create an app within 45 days (developer sandbox, November 12, 2025).
2. Pick private or public. You can't change the type later (creating an app, June 9, 2026).
   • Private: installed through a direct, unlisted link, with no review. In draft, users in the same Pipedrive company can install it. Once live, any company with the link can.
   • Public: goes through Marketplace review, which can take up to 21 business days.
3. Set the callback URL and the scopes.
4. Send the user to https://oauth.pipedrive.com/oauth/authorize, then exchange the code at /oauth/token within 5 minutes (OAuth API reference, OAuth authorization).
5. Refresh the access token every hour. Each user in the company installs the app on their own.

What we measured. Login worked with a private app still in draft, with the callback on http://localhost:3000/callback. You don't need to go live or publish to use OAuth inside your own company.

Which method popular tools use

From the docs, an n8n workflow or a community MCP server on an API token gets the token burst limit, and Zapier and Make get the OAuth one. We haven't measured those tools. All of them spend the same daily budget.

Which one to choose

Common mistakes

• Expecting OAuth to fix a daily 429. It raises the burst limit, not the daily budget.
• Building on someone else's token. The token is tied to one user. If they change it, every integration on it breaks. A community thread from 2017 says deactivating the user disables it too.
• Putting the token in the URL. Use the x-api-token header.
• Not refreshing. The access token lasts 60 minutes. If your job goes 60 days without running, the refresh token expires and the user has to log in again.
• Asking for every scope. Users see one screen and accept all or nothing. More scopes means more refusals and a harder review.
• Retrying after 429 with a token. Keep sending and you can get a 403 block. Read the headers and wait.
• Building a private app when you'll want the Marketplace. The type can't be changed later.

What we couldn't verify

• Whether the burst limit is per token or per user. Pipedrive's page says both: "considered per token, not per company" and that limits "apply at the individual user level". If it's per token, two OAuth apps for the same user would each get their own window. We haven't tested it.
• The 429 at 80. We read the OAuth limit from the header; we didn't saturate it.
• Which plan our sandbox mirrors. The 20 and 80 match Lite, but Pipedrive doesn't say what a sandbox emulates.
• What happens to an OAuth app when the user who installed it is deactivated. Not documented.
• What happens to an API token when its user is deactivated. Only a 2017 community thread without staff confirmation says it stops working.
• How to regenerate an API token. The help article doesn't explain it.
• Which scopes the official MCP asks for, and whether its traffic gets the OAuth burst limit.
• When Pipedrive introduced the 4x gap. We didn't find it in the changelog.
• Whether the daily reset moved to 08:00 UTC after the US clock change on November 1, 2026. We'll measure it again.

Where Pipehand fits

Pipehand is planned to launch in April 2027 as a replacement for Pipedrive's MCP. It will connect to Pipedrive with OAuth, as a public Marketplace app, and ask only for the scopes its features need. It's designed to read the burst and daily limits from Pipedrive's headers on every call and to keep heavy jobs within a share of your daily budget that you set, so your forms and syncs keep working.

If you want your AI to work in Pipedrive without burning the budget your other integrations need, join the waitlist on pipehand.com.

FAQ

Does Pipedrive OAuth have higher rate limits than an API token?

Yes, for bursts: 4 times more requests per 2 seconds on every plan, 80 against 20 on Lite. We read 80 and 20 in the headers of the same sandbox account in October 2026. The daily token budget is the same for both.

Do OAuth and API token requests share the same daily limit?

Yes. The daily budget belongs to the company and every integration draws from it, whichever method it uses. Both methods showed the same 150,000 daily limit in our sandbox.

Does a Pipedrive API token expire?

The docs don't give it an expiry. There's one active token per user, and changing it breaks every integration using it. OAuth access tokens last 60 minutes, and refresh tokens expire after 60 days without use.

Can I use OAuth without publishing to the Pipedrive Marketplace?

Yes. Create a private app. In draft, users in your own Pipedrive company can install it; we logged in with a draft app and a localhost callback. Once live, any Pipedrive company with the link can install it, without review.

What scopes do I need for the Pipedrive API?

It depends on what you call. base is always on. For deals, people, organizations, leads and activities you need their :read or :full scope, plus field scopes for custom fields. Merging and undoing merges worked for us with 9 scopes and no admin.

Can an admin block API tokens in Pipedrive?

Yes. Turning off "Access their own API token" in a permission set stops users from installing apps that use their token. Apps that use OAuth keep working.

For developers

Refresh, revoke and headers

• Token exchange and refresh: POST https://oauth.pipedrive.com/oauth/token with Basic auth (client_id:client_secret). The refresh token doesn't rotate: Pipedrive returns the same one, and each use extends it 60 days (OAuth authorization).
• Revoke: POST https://oauth.pipedrive.com/oauth/revoke. Revoking the refresh token removes everything and marks the app uninstalled. Revoking only the access token leaves the app installed (app uninstallation, November 12, 2025).
• Uninstall from Pipedrive: your callback URL gets a DELETE with client_id, company_id, user_id and timestamp.
• Headers: x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset are for the 2-second window. x-daily-ratelimit-token-limit and x-daily-ratelimit-token-remaining are for the daily budget. x-daily-requests-left only applies to api_token requests.
• What we saw: with an API token, x-ratelimit-limit: 20, x-ratelimit-reset: 2, and a daily limit of 150,000. With OAuth, x-ratelimit-limit: 80 and the same daily limit. Access tokens expired after 1 hour.