Skip to main content

Supported products

Serverless functions built in the design manager (served from /_hcms/api/) are being sunset:
  • November 3, 2026: you can no longer create new design manager serverless functions.
  • November 17, 2026: you can no longer edit existing design manager serverless functions, including staging and deploying serverless packages through the private beta. Existing functions keep running.
  • February 1, 2027: design manager serverless functions stop running, and requests to /_hcms/api/ fail.
Learn more in the changelog announcement.Build new serverless functions with developer projects. To move existing functions, see migrate design manager serverless functions to developer projects.
Serverless functions provide a way to execute JavaScript through HubSpot on the server-side, preventing it from being exposed to the client. This can be especially important for making API requests that contain sensitive information, such as an API key or other credentials. When running a serverless function, HubSpot executes the function on its back-end, which also means you don’t need to provide your own back-end servers to make requests for your CMS website. HubSpot’s serverless functions use the Node.js runtime. For example, you can use serverless functions to:
  • Collect and store data in HubDB or the HubSpot CRM
  • Run complex data calculators
  • Dynamically fetch and display data from external systems
  • Send form data to external systems
Below, learn more about how you can build and use serverless functions on HubSpot’s CMS.

Limits

Serverless functions are intended to be fast and have a narrow focus. To maintain performance, serverless functions built with developer projects are limited to:
  • 15 seconds of execution time per function.
  • a content type of application/json for requests that include a body. Form posts (application/x-www-form-urlencoded) return a 415 response.
Functions that exceed the account’s execution limits return a 429 response. Functions may also experience cold starts after periods of inactivity, so keep them lightweight. Learn more about limits in the reference documentation.

Building functions

There are two methods for building serverless functions and making them available for your CMS website: developer projects and the design manager. Build new functions with developer projects. Design manager functions are being sunset.

Developer projects

You can use the developer platform to build and deploy an app with serverless functions defined within it. Project-based serverless functions can include third-party dependencies from npm, and can use the app’s built-in access token for HubSpot API scopes rather than managing tokens through secrets. Build serverless functions on the latest version of the developer platform (2026.09 at the time of writing). Check developer platform versioning for the current version.
Please note: don’t build serverless functions on 2025.1 or 2025.2. Version 2025.1 is sunset, and 2025.2 doesn’t support serverless functions. Projects already on 2026.03 support serverless functions and run the same Node.js 24 runtime, so they don’t need to be migrated at this time.
Serverless functions belong to an app with static auth and private distribution, in the app’s functions directory. Each function is a pair of files:
  • *-hsmeta.json: the function’s configuration file, which includes its unique identifier, the path to its JavaScript file, the secrets it uses, and its endpoint path and methods.
  • .js file: the code that gets executed when the function is invoked. You’ll specify the file’s path in the *-hsmeta.json file.
A package.json file in the same directory configures the dependencies for every function in it.
Get started building serverless functions with projects.

Design manager

Serverless functions built in the design manager are being sunset. Don’t build new functions this way. To move existing functions to developer projects, see migrate design manager serverless functions to developer projects.
Serverless functions for the CMS were originally built in the design manager, before HubSpot’s developer projects platform was released. These functions are built locally, then uploaded to the design manager with the CLI instead of a project. They’re served from https://<domain>/_hcms/api/<endpoint>, and they can’t include third-party dependencies. A design manager function lives in a .functions directory, which can have any name that ends in .functions. The directory contains a serverless.json configuration file and the JavaScript files for each endpoint. Design manager functions have a maximum of 10 seconds of execution time. Learn more in the design manager serverless functions reference.
Design manager structure of a classic CMS serverless function

Authentication

There are two ways to authenticate requests made by serverless functions: the app’s access token and secrets.
  • App access token: because project-based serverless functions are part of an app, every function can read the app’s access token with process.env.PRIVATE_APP_ACCESS_TOKEN. Requests have access to the scopes in the app’s requiredScopes. The token is available once the app is installed in the account with hs project install-app. Calls authenticated with the token count against your API call limits.
  • Secrets: create secrets using the CLI (hs secret add <NAME>) to store credentials securely in HubSpot. You can make a secret available to a function by including the secret’s name in the config.secretKeys array of the function’s *-hsmeta.json file. Learn more about authentication in the reference documentation.
Please note:
  • You should never return secret values through console logging or as a response, as it will expose the secret to the front-end.
  • Due to caching, it can take about one minute to see updated secret values. If you’ve just updated a secret but are still seeing the old value, check again after about a minute.

Debugging

Project-based serverless functions

Log messages are produced every time HubSpot executes a serverless function, including successful requests and errors. To access a serverless function’s logs in HubSpot:
  • From the project directory, run hs project open to open the project in HubSpot.
  • Open the app that contains the serverless function.
  • Click the Logs tab.
  • View logs for specific requests by clicking the request. You can also use the search bar to search by request ID.
  • In the right panel, you can then click View log trace for a more in-depth breakdown of the request.
view-serverless-app-function-logs
You can also include console.log() in your serverless function code for debugging purposes, then view its output in the function’s log details. Note that the message will not log directly to your browser console. Running hs project logs --function <uid> in the CLI prints a link to the logs, but doesn’t show log lines for public functions. For example, your serverless function JavaScript might include:
The function’s log details would then include both messages, with the console.error() message logged as an error.

Design manager serverless functions

To help with troubleshooting your design manager serverless functions, the CLI has an hs cms function logs <endpoint> command which gives you the ability to view your function’s logs. In addition to individual function invocation responses, time of execution, and execution time, any console.log statement will also appear in function logs. Do not console.log secrets like API keys.
Last modified on November 3, 2026