Serverless Functions vs Custom-Coded Actions vs a Full Integration: Which to Use on HubSpot, and When

When you hit the edge of what HubSpot's no-code tools can do, there are three serious ways to extend the platform with real engineering: CMS serverless functions, custom-coded workflow actions, and a proper integration (a private app or hosted middleware). They look interchangeable from a distance. They are not. Choosing the wrong one is how teams end up with logic that silently times out, automation that hammers a third-party API until it gets rate-limited, or a fragile workaround that nobody can maintain six months later.

This guide gives you a decision matrix across the three approaches, by trigger, time budget, required HubSpot tier, reliability and cost. It is written for the person signing off the build, not for someone wiring it up. If you want the deeper engineering view of any one option, we link out to it as we go.

The short version: match the tool to the trigger

The single most useful question is: what sets this logic running?

• A web page, form or external request (short job, on a HubSpot-hosted page) points to a serverless function.
• A CRM record entering a workflow (short per-record logic) points to a custom-coded workflow action.
• Anything needing durable state, retries, scheduling, two-way sync or higher volume points to a full integration.

Get the trigger right and most of the other decisions fall out naturally. Below is why.

CMS serverless functions: server-side logic behind your pages

Serverless functions run Node.js on HubSpot-managed infrastructure, triggered by web requests against HubSpot-hosted CMS pages. They are the right tool for form handling, calling an external API from a page, gating content, and lightweight webhook endpoints.

The hard limits you need to plan around:

• 10 seconds maximum per function execution.
• 128 MB memory.
• 600 total execution seconds per minute at the account level. In practice that is up to 60 functions running the full 10 seconds, or thousands of fast functions, per minute. The old hard cap of a fixed number of executions per minute has been removed, so the execution-seconds budget is now the real constraint. Go over it and you get a 429.
• Tier gate: Content Hub Enterprise. This is the part teams miss. Serverless functions are not available on lower Content Hub tiers, and they only run on HubSpot-hosted pages.

Think of a serverless function as a request and response runtime. It is excellent for front-end-triggered server-side work and poor for anything that needs to run for a long time or remember state between calls.

Custom-coded workflow actions: logic inside your CRM automation

A custom-coded action runs as a step inside a HubSpot workflow, firing once per enrolled record. It is the right tool for enriching or transforming a record, conditional logic beyond the no-code builder, and a single outbound API call per record.

The limits and gates:

• 20 seconds maximum per execution (a little more headroom than serverless).
• 128 MB memory.
• Tier gate: Operations Hub / Data Hub Professional or Enterprise. (Operations Hub was renamed Data Hub in 2025; the requirement is unchanged.)
• Node.js by default, with Python in beta. Specific runtime versions change over time, so treat any version number you read elsewhere as directional.
• Secrets are stored in HubSpot and must be explicitly selected for each action in the UI. An unselected secret comes back as undefined, which is a common cause of a build that works in testing and fails in production.
• You can reference up to 50 properties per action, and string outputs are capped at 65,000 characters.

The reliability trap here is volume. Because the action runs per record, enrolling thousands of records that each call an external API can trip that API's own rate limits. That is a frequent pain point, and it is usually the signal that you have outgrown a workflow action and need a proper integration with queueing.

What serverless and custom code have in common (and where they both stop)

Both are short-lived, stateless, 128 MB sandboxes. Neither holds durable state, runs long jobs, schedules itself, or orchestrates its own queue and retry logic. Those constraints are by design and they are fine for the jobs above. The moment your requirement crosses any of those lines, you are no longer choosing between serverless and custom code. You need an integration.

A full integration: durable state, retries and ownership

A full integration means a private app or a hosted service that sits alongside HubSpot and does the heavy lifting: durable state, retries and queueing, long-running or scheduled syncs, two-way sync, and volume beyond the per-minute budgets above. It is also the category for anything you want productised and owned by you rather than living as brittle middleware or a fragile workaround.

Two distinctions matter when you scope this:

• Private app vs public app. For a single business, a private app is almost always the right vehicle. There is no certification process and no install threshold. A certified public app on the HubSpot Marketplace is a different proposition: it needs the OAuth authorisation-code flow, a verified domain, a minimum of 60 active installs to certify, a two-year recertification cycle and a security questionnaire on token handling. That bar is only relevant if you are distributing software to other companies, not solving your own problem.
• Ownership. At SpotDev we build these as productised solutions hosted on infrastructure such as Railway that the client can own outright. No black box, no lock-in to a single contractor, no surprise when a workaround quietly breaks.

Before you build anything: check what HubSpot already ships

The cheapest integration is the one you do not build. Two examples where teams reach for code unnecessarily:

• WhatsApp in the inbox. HubSpot has a native WhatsApp channel (via the WhatsApp Business API through Meta) on Marketing Hub or Service Hub Professional and above. If the requirement is simply WhatsApp messages in the conversations inbox, you usually build nothing. Building is only justified for gaps the native channel does not cover, such as syncing historical conversations or advanced routing. See our conversations inbox channels work for those edge cases.
• Cookie consent. HubSpot's native banner supports Google Consent Mode v2, but only for HubSpot's own native GA4 and Google Tag Manager integrations on a HubSpot-hosted site. It does not block third-party scripts loaded outside HubSpot, so embedded video, external tag managers and tracking pixels still fire regardless of consent. If you have third-party tags or a stricter consent requirement, that gap is where a proper build is justified. We are engineers rather than lawyers, so treat the technical capability above as the starting point and have your own legal or privacy team sign off on what your obligations actually are. Our HubSpot cookie controls page covers the build side.

How to think about cost

There is no public per-execution usage fee for serverless functions or custom-coded actions. The real cost of each approach has two parts: the HubSpot subscription tier it requires (Content Hub Enterprise for serverless, Ops Hub / Data Hub Professional or above for custom code), and the engineering effort to build and maintain it. As an indicative starting point, a serverless function build starts from £2,000 and a custom-coded action from £2,500. A conversations channel build starts from £12,000 and a Marketplace app from £18,000, reflecting the orchestration and durability work a true integration involves. Cookie controls start from £2,500.

The mistake worth avoiding is choosing the cheapest-looking tool for a job it cannot reliably do. A custom-coded action that keeps timing out or rate-limiting an API costs far more in firefighting than the integration that should have been built in the first place.

Talk to engineers, not configurators

SpotDev is the software engineering firm for HubSpot customers, a UK HubSpot Diamond Partner with an in-house engineering team and the HubSpot Custom Integration Accreditation. We Default to Build only when building is the right answer, and we back our work with a simple guarantee: delivered on time, or you get 20% back. If you are weighing up which of these three approaches fits your use case, our HubSpot development team can scope it properly. Request a quote and tell us what you are trying to achieve.

Frequently asked questions

What is the difference between a HubSpot serverless function and a custom-coded workflow action?

Both run short, stateless Node.js code in a 128 MB sandbox, but they are triggered differently. A serverless function runs in response to a web request on a HubSpot-hosted CMS page and is capped at 10 seconds. A custom-coded action runs once per record inside a CRM workflow and is capped at 20 seconds. The right choice depends on what triggers the logic: a web page and form, or a record entering a workflow.

Which HubSpot tier do I need for each option?

CMS serverless functions require Content Hub Enterprise. Custom-coded workflow actions require Operations Hub or Data Hub Professional or Enterprise (Operations Hub was renamed Data Hub in 2025). A full integration built as a private app does not require either of those specific tiers, but it does require an active HubSpot subscription with API access.

When should I build a full integration instead of using serverless or custom code?

Build a full integration when you need durable state, retries and queueing, scheduled or long-running syncs, two-way sync, or volume beyond HubSpot's per-minute execution budgets. Serverless functions and custom-coded actions are short-lived and stateless by design, so any requirement that has to remember data, retry safely or run for a long time points to an integration.

Do I need a certified Marketplace app to integrate with HubSpot?

No. For a single business solving its own problem, a private app is almost always the right vehicle. It needs no certification and no install threshold. Certification matters only if you are distributing an app to other companies on the HubSpot Marketplace, which brings requirements such as the OAuth authorisation-code flow, a verified domain, a minimum of 60 active installs and a two-year recertification cycle.

How much does each approach cost?

There is no public per-execution usage fee from HubSpot for serverless functions or custom-coded actions, so cost comes from the required subscription tier plus build and maintenance effort. As indicative starting points, a serverless function build starts from £2,000, a custom-coded action from £2,500, a conversations channel from £12,000 and a Marketplace app from £18,000. Choosing a tool that cannot reliably do the job usually costs more in maintenance than building the right thing first time.