GoHighLevel API + MCP (2026): v2, official Claude MCP server

GoHighLevel runs on one current REST surface-API v2 at services.leadconnectorhq.com, gated by a date-based Version header and either OAuth 2.0 or a Private Integration Token. The v1 API reached end-of-support on December 31, 2025 but has not been switched off, which is the biggest source of stale integrations in the ecosystem. On the agent side the verdict is unusually clean: HighLevel ships a first-party, generally available remote MCP server, so you do not need a community wrapper to give Claude write access to contacts, conversations, calendars and invoices.

At a glance

MCP integration in 2026

Most CRMs in this category still depend on community MCP wrappers or on Zapier as an intermediary. GoHighLevel does not: HighLevel publishes and operates its own remote Model Context Protocol server, authenticated with the same scopes and tokens as the REST API.

Available MCP servers

Four entries below are official HighLevel properties; the community server predates the first-party release and is now largely redundant for Claude users. Zapier reaches GoHighLevel only indirectly, via its LeadConnector app.

GoHighLevel API essentials

Everything current lives under one host and one docs site. The legacy v1 host rest.gohighlevel.com/v1 and the Stoplight docs are both on the way out and are not reference material.

The API spans roughly 40 domains, contacts, conversations, opportunities, calendars, payments, products, invoices, social planner, blogs, emails, forms, surveys, with hundreds of operations. The shape of any integration is decided by two things: which token type you hold, and whether the endpoint has been rebuilt on a newer version header. Get either wrong and the errors will not name the cause.

Authentication methods

OAuth 2.0 authorization code

Required for public marketplace apps installed across many accounts. Tokens are exchanged at /oauth/token. Access tokens last roughly 24 hours; refresh tokens last up to one year and are single-use-once exchanged, the original is invalid and a new one arrives in the same response. A client that keeps the old refresh token locks itself out on the next cycle.

Private Integration Token (PIT)

A PIT is a static OAuth 2.0 access token created under Settings › Private Integrations at agency or sub-account level. Scopes are chosen at creation, the value is shown once, and it is sent as Authorization: Bearer pit-…. This is the intended path for internal tools and no-code platforms. Make, n8n, Zapier and custom scripts. It replaces the v1 API key, which was unrestricted and should be retired wherever it survives. HighLevel advises against PITs for public apps and recommends rotating every 90 days.

Agency tokens vs location tokens

A company token addresses agency-level APIs; a location token addresses one sub-account. Multi-tenant apps mint a location token from an agency token via POST /oauth/locationToken-which is why a token that works in Postman for one client returns empty arrays for another.

Rate limits

The per-app, per-resource rule matters for agencies: a fleet of sub-accounts does not share one 200,000-request pool, but one noisy sync job can exhaust a single client’s day. The workaround pattern: page reads through POST /contacts/search with searchAfter rather than looping skip, use POST /contacts/upsert instead of read-then-write pairs, drive change detection from webhooks instead of polling, and back off against the 10-second burst window rather than a fixed sleep. These API limits are separate from the email caps above: hitting the API ceiling throttles requests, hitting the SMTP relay cap destroys credentials.

Official SDKs

HighLevel maintains three language SDKs plus a CLI and an app scaffold, all generated from the API spec and published under the GoHighLevel GitHub organisation. The TypeScript client is the most complete and the only one with built-in OAuth refresh, session storage and webhook signature verification.

Notable community SDKs

First-party clients arrived late, so a long tail of community wrappers still circulates, many written against v1 and its unrestricted API key. That is the filter: if a library authenticates with a bare API key and points at rest.gohighlevel.com, it targets a dead surface no matter how recent the README. The most durable community assets are not SDKs but the MCP servers above and the maintained Make modules, which track v2.

Endpoints reference

The fifteen endpoints below carry most integration traffic. The full reference, products, workflows, social planner, forms, surveys, blogs, is at marketplace.gohighlevel.com/docs. Paths are relative to https://services.leadconnectorhq.com.

Code examples

Python: upsert a contact, then search

import requests

BASE = "https://services.leadconnectorhq.com"
TOKEN = "pit-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"  # Private Integration Token
LOCATION_ID = "your_sub_account_location_id"

headers = {
    "Authorization": f"Bearer {TOKEN}",
    "Version": "2021-07-28",   # required date-based API version header
    "Accept": "application/json",
    "Content-Type": "application/json",
}

# Upsert a contact in a sub-account (location)
payload = {
    "locationId": LOCATION_ID,
    "firstName": "Ada",
    "lastName": "Lovelace",
    "email": "ada@example.com",
    "tags": ["smtpedia-demo"],
}

r = requests.post(f"{BASE}/contacts/upsert", headers=headers, json=payload, timeout=30)
r.raise_for_status()
print(r.json())

# Search: newer endpoint, requires Version: v3 instead of the date header
r2 = requests.post(
    f"{BASE}/contacts/search",
    headers={**headers, "Version": "v3"},
    json={"locationId": LOCATION_ID, "pageLimit": 20},
    timeout=30,
)
print(r2.json())

Node: official SDK and the raw fetch equivalent

// Official SDK: npm install @gohighlevel/api-client
import HighLevel from '@gohighlevel/api-client';

const ghl = new HighLevel({
  privateIntegrationToken: process.env.GHL_PIT, // pit-...
});

const contact = await ghl.contacts.getContact({ contactId: 'contact-uuid' });
console.log(contact);

// Raw fetch equivalent, no SDK:
const res = await fetch('https://services.leadconnectorhq.com/contacts/upsert', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GHL_PIT}`,
    Version: '2021-07-28',            // required
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    locationId: process.env.GHL_LOCATION_ID,
    firstName: 'Ada',
    email: 'ada@example.com',
  }),
});
console.log(await res.json());

Connecting the official MCP server to Claude

# Claude Code, per-client endpoint (richest toolset)
claude mcp add --transport http leadconnector https://services.leadconnectorhq.com/mcp/anthropic/v2

# Universal endpoint for any HTTP MCP client, via .mcp.json
{
  "mcpServers": {
    "leadconnector": {
      "type": "http",
      "url": "https://services.leadconnectorhq.com/mcp/",
      "headers": {
        "Authorization": "Bearer pit-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "locationId": "your_sub_account_location_id"
      }
    }
  }
}

Common gotchas

Deprecations and changelog

• August 19, 2026-“Email Events: Message ID Now Available in the Dynamic Picker”, the unique message identifier for opens and clicks is exposed to workflows, enabling per-message reconciliation against LC Email logs.
• July 9, 2026-Developer AMA on migrating from API v1 to v2, covering Private Integration Tokens versus OAuth 2.0 and scope design.
• May 1, 2026-Official TypeScript/JavaScript SDK @gohighlevel/api-client released v3.0.0, adding automatic OAuth refresh, pluggable session storage and webhook signature verification.
• December 31, 2025-API v1 reached official end-of-support. Existing integrations keep working but receive no updates or support; docs moved to marketplace.gohighlevel.com/docs, with the legacy Stoplight docs slated for deprecation.
• November 19, 2025-Official Python SDK published its first release, gohighlevel-api-client v1.0.0-beta.1.

Product changes land at ideas.gohighlevel.com/changelog; API changes at marketplace.gohighlevel.com/docs. Watch both: the streams do not mirror each other.

Frequently asked questions