Agentic Fabriq
Apollo.io
BUSINESS · CRM & SUPPORT
People search, enrichment, accounts, deals, and sequences on their own workspace.
Connecting Apollo.io in practice
An Apollo API key identifies a workspace rather than a person, and Apollo says every API-key request "acts as your workspace’s longest-standing active admin", so records an agent creates are owned by someone who never touched it. Limits are enforced per team, per endpoint and in three windows at once — minute, hour and day — and the windows open on your first request rather than aligning to the clock.
Scopes that draw scrutiny
Master keyApollo’s own wording: "Turning on the Set as master key toggle gives the key access to every endpoint." Some endpoints, such as listing users, work only with one, and Apollo’s advice is the opposite — "Give each key only the endpoints it actually needs."contacts_searchOne of the OAuth scopes in Apollo’s own authorize example. It searches the workspace’s saved contact records rather than the public database, so it reads the customer’s CRM.opportunity_writeAppears in Apollo’s documented token response. It writes pipeline data, which is the part of a CRM that feeds revenue reporting.app_scopesAdded automatically alongside read_user_profile and standing in for "all selected scopes", so the granted scope string does not enumerate what the token can reach.
Rate limits
- Every limit is per team, not per API key or per user, and child workspaces share the limits of their parent workspace.
- Plan limits, per endpoint: Free 50 per minute, 200 per hour, 600 per day. Basic and Professional 200 per minute, 400 per hour, 2,000 per day. Organization 200 per minute, 600 per hour, 6,000 per day.
- Search endpoints on paid plans: 200 per minute, 6,000 per hour, 50,000 per day. Enrichment endpoints on paid plans: 1,000 per minute with no hourly and no daily limit.
- Query analytics report: 5 requests per hour. Export conversations on Free: 1 request per minute and 20 per hour.
- Windows are fixed rather than clock-aligned: "A window opens when you send your first request to an endpoint and closes when the window’s duration elapses."
Who has to approve
Apollo gates the consent itself. A user authorizing an integration needs the "Can authorize third-party apps/integrations via OAuth" permission, or on plans without custom permission profiles must hold Admin or Billing and Seat Manager. A user without it is bounced back with status_code=403 and "You do not have permission to connect integrations. Please contact your Apollo admin to review and authorize this integration". Apollo also reviews the OAuth app registration before the flow can be used at all.
Worth knowing
- Access tokens last 30 days (expires_in 2592000), and using the refresh token revokes both existing tokens immediately, so the token store has to be transactional rather than best effort.
- Editing the app’s scope list means "you need to repeat this entire authorization flow to set up OAuth again" — every connected user re-consents.
- Credits are a second budget on top of the rate limit: people enrichment costs 1 to 9 credits per person "charged only if credit-consuming data is found", organization search 1 credit per page of up to 100 results, news search 1 credit per page of 25.
- Free accounts "must be registered with a work email address to use certain people and organization search, enrichment, and record-retrieval endpoints", so a pilot on a personal address fails on a subset of endpoints rather than at login.
Checked against Apollo API authentication (2026-09-29), Apollo rate limits (2026-09-29), Create an API key (2026-09-29), OAuth 2.0 for partners (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Apollo.io behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.