Twenty CRM API
Open-source, self-hostable CRM with a GraphQL and REST API for managing contacts, companies, opportunities, and custom objects with a Notion-like flexible data model.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
TLS enforcement depends on operator's self-hosted configuration — not guaranteed by default. OAuth2 and API key auth both supported. Open source means full code auditability. GDPR compliant.
⚡ Reliability
Best When
An agent deployment requires data sovereignty, on-premise CRM access, or full customization of the CRM data model without SaaS vendor constraints.
Avoid When
You need a production-ready managed CRM with enterprise support SLAs and a mature integration ecosystem out of the box.
Use Cases
- • Building agent workflows against a fully self-hosted CRM with no vendor lock-in or data sovereignty concerns
- • Creating and querying custom CRM objects and fields via the metadata API to model domain-specific data
- • Syncing contacts and companies from external sources using the GraphQL mutations API
- • Querying opportunity pipeline stages to drive agent follow-up and outreach workflows
- • Integrating with agent infrastructure that requires on-premise or private-cloud CRM deployment
Not For
- • Teams that need a fully managed, hosted CRM with no infrastructure responsibility
- • Non-technical buyers who cannot manage a self-hosted deployment or use Twenty Cloud's limited managed tier
- • Enterprises needing mature ecosystem integrations like Salesforce AppExchange equivalents
Interface
Authentication
API key for server-to-server agent use. OAuth2 for user-facing flows. Keys generated from Twenty workspace settings. GraphQL endpoint uses Bearer token auth.
Pricing
Open source under MIT license — self-hosting is free with no API call limits. Twenty Cloud managed tier available for teams that don't want to self-host.
Agent Metadata
Known Gotchas
- ⚠ MCP server is early-stage and self-hosted — agents using it must manage the MCP server lifecycle as part of their infrastructure
- ⚠ The metadata API (for creating/modifying custom objects and fields) is a separate API surface from the data API — agents need to understand the two-layer architecture
- ⚠ Self-hosted performance and uptime are entirely operator-dependent — SLA guarantees require your own infrastructure investment
- ⚠ GraphQL schema introspection is available but custom objects added via metadata API require a schema refresh cycle before they appear
- ⚠ Twenty is rapidly evolving; self-hosted deployments may fall behind cloud versions and breaking changes in minor versions are possible during early releases
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Twenty CRM API.
Scores are editorial opinions as of 2026-03-06.