What is the GoHighLevel API v2?
GoHighLevel API v2 is HighLevel's current REST API for reading and writing account data such as contacts, opportunities, calendars, conversations and custom objects. It lives at services.leadconnectorhq.com, uses Bearer tokens from a Private Integration or OAuth 2.0, and requires a Version header on each request.
If your integration was built a few years ago with an API key from Settings, it is on API v1. HighLevel's migration guide, modified August 21, 2026, says: "HighLevel API v1 reached end-of-support on December 31, 2025. Existing v1 integrations may continue to work, but they are no longer maintained or supported." This guide covers what replaced it and how to choose between the two ways to authenticate.
Which plans include GoHighLevel API access?
All three plans include some API access. HighLevel's API documentation article says Starter and Unlimited include basic API access, and Agency Pro, $497 a month at the time of writing, includes advanced access, which adds agency-level keys and future OAuth 2.0 endpoints.
| Plan | API access | What that means |
|---|---|---|
| Starter ($97/mo) | Basic | Location (sub-account) level access |
| Unlimited ($297/mo) | Basic | Location (sub-account) level access |
| Agency Pro ($497/mo) | Advanced | Agency-level keys as well as location access |
Source: HighLevel API Documentation, modified August 18, 2026. The same article says the option to generate new legacy API keys is being removed from agency and sub-account settings for accounts not already using one.
Private Integration token or OAuth: which should you use?
Use a Private Integration token when you are connecting your own agency or sub-account to a tool you control. Use OAuth 2.0 when you are building an app that other agencies or sub-accounts will install, or when one integration needs user-approved access across many accounts.
| Private Integration token | OAuth 2.0 | |
|---|---|---|
| Best for | Your own account and internal tools | Marketplace apps and multi-account installs |
| How you get it | Created in Settings, Private Integrations | Generated in code after the user authorizes your app |
| How long it lasts | Fixed until you rotate it | Access token valid for a day; refresh token for a year |
| Scopes | Chosen when you create it | Requested by your app, approved at install |
| Upkeep | Rotate on a schedule | Refresh in code before each call fails |
How do you create a GoHighLevel Private Integration token?
In Settings, open Private Integrations, click Create new Integration, give it a name and description, select only the scopes the tool needs, and copy the token. HighLevel shows the token once, so store it in a password manager or secrets store right away.
- Open Settings in the agency or the sub-account the integration will use. HighLevel says Private Integrations can be created at both levels.
- Open Private Integrations and click Create new Integration.
- Name it after the tool it is for, such as "Warehouse sync" or "Practice system".
- Select scopes. HighLevel's advice: "Ensure that you are selecting only the required scopes for better data security."
- Copy the token and store it safely. It will not be shown again.
A few limits from HighLevel's Private Integrations article (modified September 29, 2026): up to 20 tokens at the agency level and 20 at each location, all agency admins can create them by default, and you can restrict that in Roles and Permissions. Create a separate integration per tool, so you can rotate or revoke one without breaking the others.
How often should you rotate a Private Integration token?
HighLevel recommends rotating every 90 days. When you choose "Rotate and expire this token later", the old and new tokens both work for seven days, which gives you time to update the tool. If a token leaks, choose "Rotate and expire this token now" instead.
During the seven-day window you can cancel the rotation if the tool needs more time, or expire the old token early once the tool is updated. Put the rotation date in a shared calendar with the name of the tool and who updates it. A token that expires without anyone noticing is one of the easiest ways for a working integration to stop.
How do OAuth tokens work in GoHighLevel?
After a user installs your app, you receive an access token and a refresh token. The access token is valid for a day. The refresh token is valid for a year, and each time you use it you get a new refresh token valid for another year. Your code should refresh and store both tokens when a call fails for expiry.
HighLevel's OAuth FAQ recommends a wrapper around every API call: try the call, refresh if the token has expired, save both new tokens, then retry. Store tokens per install, because each sub-account or agency that installs your app has its own pair.
What are the GoHighLevel API rate limits?
API v2 allows a burst of 100 requests per 10 seconds and 200,000 requests per day, counted per Marketplace app per resource, where a resource is one sub-account or one agency. Each install gets its own budget, so more installs do not divide your allowance.
Every response carries headers you can use to slow down before you hit the limit:
| Header | Meaning |
|---|---|
| X-RateLimit-Limit-Daily | Your daily limit |
| X-RateLimit-Daily-Remaining | Requests left today |
| X-RateLimit-Interval-Milliseconds | The burst window |
| X-RateLimit-Max | Maximum requests in that window |
| X-RateLimit-Remaining | Requests left in the current window |
Source: HighLevel Marketplace, Rate Limits, read October 6, 2026. In practice, 100 per 10 seconds is about 10 a second, which a bulk import or a two-way sync after a big edit will reach. Queue writes and back off when X-RateLimit-Remaining gets low.
What does a GoHighLevel API v2 request look like?
A request goes to services.leadconnectorhq.com with an Authorization header carrying your Bearer token and a Version header. HighLevel's own example for reading a location uses the version value 2021-07-28.
curl --request GET \
--url https://services.leadconnectorhq.com/locations/YOUR_LOCATION_ID \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_PRIVATE_INTEGRATION_TOKEN' \
--header 'Version: 2021-07-28'This example is adapted from HighLevel's Private Integrations documentation. The migration guide notes that newer APIs may use named versions such as v3, so check the version value on each endpoint's page before you build against it.
How do you migrate from GoHighLevel API v1 to v2?
List every tool using a v1 key, create a Private Integration per tool with only the scopes it needs, update each tool to send the new Bearer token and Version header, test, then retire the v1 key. Endpoints and field names can differ, so expect to change some code as well as the key.
- Inventory. Zapier zaps, n8n workflows, custom scripts, plugins and vendor tools. Ask vendors whether they already support v2. Our Zapier automation and n8n automation services update both kinds of workflow.
- One integration per tool. Name it after the tool and select its scopes.
- Update requests. New base URL, Bearer token, Version header, and the v2 endpoint for each call.
- Test in a test sub-account. Create, update and delete a record; check custom fields map correctly.
- Switch and watch. Monitor errors for a week before removing the old key.
When should you hire a GoHighLevel API developer?
Hire one when the integration is two-way, high volume, touches custom objects, has to install across many sub-accounts with OAuth, or carries data where a lost record costs money. For a single one-way push, a webhook or n8n is often enough; our inbound webhook trigger guide covers that case, and the FAQ on why a webhook is not firing covers the usual faults.
Autoesta's GoHighLevel API integration service builds these with a written data map, narrow scopes, rate-limit handling, logging and alerts. Small builds cost about $1,000 at the time of writing, and the audit is free. For a GoHighLevel and n8n build in practice, see the Smile Bright dental case study; for integrations that do not involve HighLevel, see API integration services. Health data needs more care; see our HIPAA automation guide. If you are not sure the API is the right tool, read our guide to choosing a GoHighLevel integration method first.
Questions about the GoHighLevel API
Where do I find my GoHighLevel API key?
New integrations use a Private Integration token from Settings, Private Integrations, instead of a legacy API key. HighLevel is removing the option to generate new legacy keys for accounts not already using one.
Is GoHighLevel API v1 still working?
It may still work, but support ended on December 31, 2025, and HighLevel no longer maintains it. Plan a move to v2 before something breaks.
Can I use the GoHighLevel API on the Starter plan?
Yes. HighLevel's documentation says Starter and Unlimited include basic API access at the location level. Agency-level keys need Agency Pro.
What happens when I hit the GoHighLevel rate limit?
Expect requests above the limit to be refused until the window resets. Read the X-RateLimit-Remaining header and slow down before it reaches zero, and retry refused requests with a delay.
How many Private Integration tokens can I create?
Up to 20 at the agency level and up to 20 at each location, according to HighLevel's Private Integrations article.
Sources
- HighLevel Help Center, HighLevel API Migration Guide, modified August 21, 2026.
- HighLevel Help Center, Private Integrations: Everything you need to know, modified September 29, 2026.
- HighLevel Help Center, HighLevel API Documentation, modified August 18, 2026.
- HighLevel Marketplace docs, Private Integrations, OAuth FAQs and Rate Limits, read October 6, 2026.
