Hashnode
MESSAGING · MESSAGING
Posts, drafts, and publications, written as the author who connected.
Connecting Hashnode in practice
Since 13 May 2026 every Hashnode GraphQL request, query or mutation, requires the target publication to be on the Pro plan, and the refusal arrives as a FORBIDDEN error mentioning the Pro plan rather than as a billing signal — so retrying never helps. Query depth is capped at 10, page size at 100 and 50 for drafts, and the published targets of 20,000 queries and 500 mutations a minute are advisory because Hashnode says rate limiting is not currently enforced.
Scopes that draw scrutiny
Authorization: Bearer <Personal Access Token>Hashnode’s own guidance is to treat it like a password, because it can publish, edit and delete content on every publication the user has. There are no per-operation scopes to narrow it with.x-hashnode-clientA non-secret client identifier Hashnode asks every caller to send so its API can separate one integration’s traffic from another’s.
Rate limits
- Published targets of 20,000 queries per minute and 500 mutations per minute, which Hashnode states are not currently enforced by the server.
- Maximum query depth 10; deeper queries are rejected outright.
- Page size: 100 for most connections and 50 for draft connections. Values above the cap are clamped rather than rejected.
- Request body 100 KB; image uploads 8 MB, image/* only and no SVG; 15 tags per post or draft.
Worth knowing
- An inaccessible draft returns NOT_FOUND rather than FORBIDDEN by design, so an agent that retries with better credentials is chasing something that does not exist for it.
- A CONTRIBUTOR on a team publication cannot publish or create posts directly: writes have to go createDraft, updateDraft, submitDraftForReview and then wait for an owner or editor to publish or reject.
- Query responses may be cached for about 25 seconds while mutations are never cached, so a read issued straight after a write can return the old value.
- presignedPost on createImageUploadURL was deprecated on 1 September 2026 and removed on 7 September 2026, replaced by presignedPut followed by confirmImageUpload.
Checked against GraphQL API now requires Pro (2026-09-29), Errors and limits reference (2026-09-29), Authentication and roles reference (2026-09-29), presignedPost deprecation (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Hashnode behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.