GoHighLevel
Connect GoHighLevel to manage contacts, conversations, pipelines, calendars, invoices, and marketing for your sub-account.
You end up pasting two things into PopMCP: a Private Integration Token (a one-time-visible string starting with pit-) and the Location ID of the sub-account it should control.
- Setup time
- 6 min
- Auth
- API credentials
- API base URL
- https://services.leadconnectorhq.com
- Rate limits
- HighLevel API 2.0 allows roughly 100 requests per 10 seconds in burst and 200,000 requests per day, counted per resource.
Before you begin
- A HighLevel (GoHighLevel) sub-account you can open
- Admin user on that sub-account, or agency access to it
- Private Integrations visible under Settings. On older accounts you may have to switch it on under Settings -> Labs first
- A free slot for a new token. Each location holds at most 5 Private Integration Tokens
Get your credentials
Open the sub-account and copy its Location ID
Switch into the sub-account PopMCP should control and open Settings -> Business Profile. Copy the /location/\<id>/ segment out of the address bar.
Business Profile
Details, address and preferences for this sub-account.
- URL
- app.gohighlevel.com/v2/location/aB3xQ9kLmN2pR7tV/settings/business_info
- Location ID
- aB3xQ9kLmN2pR7tV
PopMCP accepts the bare id or any sub-account URL that contains it.
Go to Settings -> Private Integrations
In the sub-account left nav click Settings, then Private Integrations in the settings list. If the item is missing, switch it on under Settings -> Labs and reload.
Private Integrations
Tokens that let your own tools call the HighLevel API for this sub-account.
| Name | Token | Scopes | Status | Created |
|---|---|---|---|---|
| Reporting syncNightly export to Looker | pit-****9c41 | 3 scopes | Active | Mar 4, 2026 |
| Zapier bridgeLead handoff | pit-****02d7 | 6 scopes | Expiring | Feb 18, 2026 |
The row menu offers Update, Delete, and two rotate options.
Name the integration and tick the scopes
Click Create new Integration, name it PopMCP, and write a one-line description. Tick View/Edit Contacts, View/Edit Conversations, View/Edit Opportunities, View Calendars and Edit Calendar Events, plus the invoice scopes if you bill through HighLevel.
Create new Integration
Give your Private Integration a name and description, then pick its scopes.
Copy the token before you close the dialog
Click Copy token on the pit-... value in the confirmation dialog. If you lose it, delete the integration and create a new one.
Private Integrations
Rotating a token later keeps the old one alive for a 7-day grace period. Rotating it now expires the old one immediately.
Paste the token and Location ID into PopMCP
Put the pit-... string in Private Integration Token and the sub-account id in Location ID (sub-account), then click Connect.
Connect in PopMCP
Open your workspace, choose GoHighLevel in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Private Integration Tokensecret | HighLevel → Settings → Private Integrations → Create new integration → select scopes → copy the token (shown once). Sent as Authorization: Bearer. Stored encrypted, used server-side only. Grant every scope you want the AI to use (e.g. contacts, conversations, opportunities, calendars, invoices, payments). A call to an ungranted scope is rejected.Encrypted with AES-256-GCM on save and never shown again. |
| Location ID (sub-account)text | The sub-account this connection controls. Find it in the sub-account under Settings → Business Info, or copy it from the app URL (the /location/<id>/ segment). Paste just the id, or a URL that contains it. We'll pull it out. Every call is scoped to this sub-account automatically. |
PopMCP verifies the credential against GoHighLevel immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the connector as Connected and names the sub-account (for example "Northwind Dental") next to it. Ask the assistant to list a few recent contacts. If that returns rows, both the token and the Location ID are right.
Troubleshooting
401 Unauthorized on every call
Why: The token was copied with trailing whitespace, was rotated or deleted, or you pasted an agency-level token while asking for sub-account data.
Fix: Create a fresh Private Integration inside the sub-account itself and paste the new pit- token.
403 Forbidden on some tools only
Why: That endpoint's scope was not ticked when the integration was created. A call to an ungranted scope is rejected outright.
Fix: Open Settings -> Private Integrations, use the row menu to Edit the integration, add the missing scope, then reconnect in PopMCP.
Connection saves but returns data for the wrong business
Why: The Location ID came from a different sub-account, or from an agency-level URL.
Fix: Switch into the correct sub-account, re-copy the /location/<id>/ segment from the URL, and update the Location ID field.
Private Integrations is missing from the Settings list
Why: The feature has not been switched on for the account.
Fix: Go to Settings -> Labs, enable Private Integrations, reload, and the menu item appears.
"Cannot create more integrations"
Why: The location already holds the maximum of 5 Private Integration Tokens.
Fix: Delete an unused integration, then create the PopMCP one.
The token stops working after a scheduled rotation
Why: Someone used "Rotate and expire this token later" on the row menu, which retires the old value.
Fix: Copy the new token from the rotation dialog and paste it into PopMCP before the old one expires.