GoHighLevel API - Docs, Access Tokens, Limits and What It Can Do (2026)

Yes, GoHighLevel has a full REST API. The official documentation lives at marketplace.gohighlevel.com/docs, every request goes to services.leadconnectorhq.com, and you authenticate with either a Private Integration Token (for your own tools) or OAuth 2.0 (for Marketplace apps). API V1 and its API keys reached end of support on December 31, 2025, so new work should use V2's date-based versions or the newer v3.

HighLevel's help center says API access is included on every plan, from the $97 Starter plan up, with only a few agency endpoints reserved for the $497 plan. The default rate limit is 100 requests per 10 seconds and 200,000 per day for each app on each account.

This guide covers where the docs are, which token to use, plan access, rate limits, webhooks and the jobs the API is actually good for. For apps that connect without code, start with our GoHighLevel integrations guide.

GoHighLevel API at a Glance

Where to Find the GoHighLevel API Documentation

HighLevel's help center says its API documentation is now at marketplace.gohighlevel.com/docs and asks developers who used the older Stoplight pages to update their bookmarks, because Stoplight is being deprecated. Searches for "GoHighLevel documentation" and "GoHighLevel API docs" should land there.

The documentation is organized in three parts:

• API reference: every endpoint with its parameters, required scopes, example payloads and code samples. A version switcher lets you view a specific API version.
• Guides: OAuth, Private Integrations, scopes, webhooks, Marketplace app publishing and the SDKs.
• AI-friendly files: HighLevel publishes llms.txt indexes of the reference. Its index lists 821 endpoints in v3 and 739 in the 2023-02-21 version.

If an endpoint you need is missing, HighLevel asks developers to request it through the GitHub issues page for its API docs. For general product help, see our GoHighLevel login and support guide.

API V1 vs V2 vs V3

Most outdated tutorials still show you how to copy an "API key" from settings. That is the V1 method, and it is gone for new builds.

HighLevel's help center adds that the ability to generate new API keys is being removed from agency and sub-account settings for accounts that are not already using one. Its versioning guide says that when a new version ships, the previous one enters a maintenance window with critical fixes only, and a retired version stops accepting requests.

Private Integration Tokens vs OAuth 2.0

Both methods send a token in the Authorization header as "Bearer" plus the token. The difference is who creates the token and how long it lives.

HighLevel calls Private Integration Tokens "static/fixed OAuth2 Access Tokens." They replace the old API keys, with one big security gain: you choose exactly which scopes a developer gets instead of handing over the whole account.

How to Create a Private Integration Token

Agency admins can restrict who manages Private Integrations under Settings > Team > Roles & Permissions. Editing a token's name or scopes later does not change the token itself.

How OAuth Works for Marketplace Apps

If you are building an app other agencies will install, you need OAuth and a developer account. HighLevel's steps are:

1. Sign up at marketplace.gohighlevel.com and verify your phone and email. The first user becomes the only Owner, so add teammates as users rather than sharing a login.
2. Create an app to get a client ID and secret, and choose its scopes.
3. Set the distribution model. You pick whether the target user is an agency or a sub-account, and who can install it. HighLevel says bulk installation by agencies is now mandatory for new Marketplace apps.
4. Exchange the authorization code for an access token and refresh token, and refresh the access token daily.
5. Subscribe to webhooks so your app hears about changes in real time.

An agency token can also be exchanged for a sub-account (location) token, which is how one app works across many client accounts.

Which Plans Include API Access?

This is where HighLevel's own pages disagree, so read them side by side.

The firm rule in the help center is that two endpoints need the $497 plan: Create Sub-Account and Enable SaaS for Sub-Account. That plan is called Agency Pro in the help center and Founder on the current pricing page.

For full plan details and usage charges, see our GoHighLevel pricing guide.

GoHighLevel API Rate Limits

HighLevel's rate limits apply per app (or Private Integration) per resource, where a resource is one sub-account or one agency.

A few details matter when you plan an integration:

• More installs do not split your budget. An app installed on two sub-accounts gets the full allowance on each.
• Private Integration Tokens share a daily counter. Each PIT has its own burst limit, but all PITs on the same sub-account share one 200,000-a-day budget.
• Windows are fixed, not calendar-based. The daily window does not reset at midnight; it starts with your first counted request.
• Rejected calls are free. A request rejected with a 429 error does not count against either limit.

Every response carries headers such as X-RateLimit-Remaining, X-RateLimit-Daily-Remaining and X-RateLimit-Daily-Reset. Read them and slow down before you hit zero, rather than counting requests yourself.

Webhooks in the GoHighLevel API

Webhooks let HighLevel notify your system the moment something changes, so you do not have to poll the API.

There are two kinds, and they are easy to confuse:

App webhooks cover events such as contact created or updated, tag changes, appointments, opportunities, invoices, notes, inbound messages and app installs. HighLevel's webhook documentation includes a sample payload for each event.

Verify every delivery before you trust it. HighLevel signs webhooks with an X-GHL-Signature header (Ed25519) and publishes the public key in its webhook guide. Some OAuth app webhooks also carry a legacy X-WH-Signature header during the transition.

Workflow webhooks, including the premium inbound webhook trigger, are covered in our integrations guide.

Making Your First GoHighLevel API Call

Every request needs the same three pieces:

A simple first test is creating a contact. HighLevel's Private Integrations guide shows a POST to the contacts endpoint with a first name, last name, email, phone and the locationId (the sub-account ID). If the contact appears in that sub-account, your token, scopes and headers are all working.

Official SDKs and the MCP Server

You do not have to hand-write every request. HighLevel ships official SDKs:

HighLevel says all three handle OAuth flows, PIT support, token refresh and webhook signature checks.

HighLevel also runs a LeadConnector MCP server that lets AI assistants such as Claude, ChatGPT and Cursor work with CRM data through an OAuth connection. Its documentation lists more than 550 operations, limited by the scopes you approve. See our GoHighLevel AI guide for the built-in AI tools.

What People Build With the GoHighLevel API

Agencies running a SaaS offer get the most from the sub-account endpoints, which our GoHighLevel for agencies guide explains.

API vs Zapier, Make and n8n

The API is the most flexible option, but it is rarely the first one to reach for.

Compare the no-code routes in GoHighLevel vs Zapier and GoHighLevel vs n8n.

Hiring a GoHighLevel Developer

HighLevel support does not write or debug integration code, so many agencies hire a developer. Ask any candidate these questions:

• Do you build on V2 or v3 with Private Integration Tokens or OAuth? Anyone still asking for an "API key" is working from V1 methods.
• How will you handle rate limits and 429 errors? Look for retries with backoff and use of the rate limit headers.
• How will you store tokens? Tokens belong in a secrets store, never in code or spreadsheets.
• Will you verify webhook signatures? The answer should be yes.
• Who owns the developer account and code? Make sure your business does.

For community help, HighLevel runs a developer Slack group and a monthly Developer Council call, and accepts bug reports through its developer support form.

Common GoHighLevel API Mistakes

• Following V1 tutorials. Location API keys and the old Stoplight docs are retired or being retired.
• Over-scoping tokens. Give each Private Integration only the scopes it needs.
• Forgetting the Version header. Requests without the right version fail or return a different schema.
• Polling instead of using webhooks. Polling burns your rate limit; webhooks are near real time.
• Assuming the plan. Sub-account creation and SaaS endpoints need the top plan.
• Skipping token rotation. HighLevel recommends rotating Private Integration Tokens every 90 days.

Our Verdict

The GoHighLevel API is mature and open on every plan, according to HighLevel's help center. The documentation is now in one place, official SDKs exist for three languages, and the rate limits are generous for most agency projects.

The main traps are outdated V1 tutorials and the mixed messages about plan access. Use Private Integration Tokens for your own tools, OAuth for anything you will distribute, and test the exact endpoints you need on your intended plan during the free trial. For the no-code side, read our GoHighLevel integrations guide and the full GoHighLevel review.

Frequently Asked Questions