GoHighLevel OAuth 2.0 Marketplace App Setup

const GHL_CLIENT_ID = process.env.GHL_CLIENT_ID;
const REDIRECT_URI = 'https://yourapp.com/ghl/callback';

// Scopes your app needs - select only what you use
const SCOPES = [
  'contacts.readonly',
  'contacts.write',
  'calendars.readonly',
  'calendars.write',
  'opportunities.readonly',
  'opportunities.write',
  'locations.readonly',
].join(' ');

export function GET(req) {
  const params = new URLSearchParams({
    client_id: GHL_CLIENT_ID,
    redirect_uri: REDIRECT_URI,
    response_type: 'code',
    scope: SCOPES,
  });
  const authUrl = `https://marketplace.gohighlevel.com/oauth/chooselocation?${params}`;
  return Response.redirect(authUrl, 302);
}

import os
from fastapi import FastAPI
from fastapi.responses import RedirectResponse
from urllib.parse import urlencode

app = FastAPI()
GHL_CLIENT_ID = os.environ["GHL_CLIENT_ID"]
REDIRECT_URI = "https://yourapp.com/ghl/callback"
SCOPES = " ".join([
    "contacts.readonly",
    "contacts.write",
    "calendars.readonly",
    "calendars.write",
    "locations.readonly",
])

@app.get("/connect-ghl")
def connect_ghl():
    params = urlencode({
        "client_id": GHL_CLIENT_ID,
        "redirect_uri": REDIRECT_URI,
        "response_type": "code",
        "scope": SCOPES,
    })
    return RedirectResponse(
        url=f"https://marketplace.gohighlevel.com/oauth/chooselocation?{params}"
    )

const GHL_CLIENT_ID = process.env.GHL_CLIENT_ID;
const GHL_CLIENT_SECRET = process.env.GHL_CLIENT_SECRET;
const REDIRECT_URI = 'https://yourapp.com/ghl/callback';

export async function GET(req) {
  const url = new URL(req.url);
  const code = url.searchParams.get('code');
  if (!code) return Response.json({ error: 'Missing code' }, { status: 400 });

  const res = await fetch('https://services.leadconnectorhq.com/oauth/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      client_id: GHL_CLIENT_ID,
      client_secret: GHL_CLIENT_SECRET,
      redirect_uri: REDIRECT_URI,
      code,
      grant_type: 'authorization_code',
    }),
  });

  const tokens = await res.json();
  // tokens = { access_token, refresh_token, token_type, expires_in, locationId, userId }

  // Store in your database
  await db.upsert('ghl_tokens', {
    userId: tokens.userId,
    locationId: tokens.locationId,
    accessToken: tokens.access_token,
    refreshToken: tokens.refresh_token,
    expiresAt: Date.now() + tokens.expires_in * 1000,
  });

  return Response.redirect('/dashboard', 302);
}

import os
import time
import requests
from fastapi import FastAPI
from fastapi.responses import RedirectResponse

app = FastAPI()
GHL_CLIENT_ID = os.environ["GHL_CLIENT_ID"]
GHL_CLIENT_SECRET = os.environ["GHL_CLIENT_SECRET"]
REDIRECT_URI = "https://yourapp.com/ghl/callback"

@app.get("/ghl/callback")
def ghl_callback(code: str):
    res = requests.post(
        "https://services.leadconnectorhq.com/oauth/token",
        data={
            "client_id": GHL_CLIENT_ID,
            "client_secret": GHL_CLIENT_SECRET,
            "redirect_uri": REDIRECT_URI,
            "code": code,
            "grant_type": "authorization_code",
        },
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    res.raise_for_status()
    tokens = res.json()

    # Store in your database (pseudocode)
    save_tokens(
        user_id=tokens["userId"],
        location_id=tokens["locationId"],
        access_token=tokens["access_token"],
        refresh_token=tokens["refresh_token"],
        expires_at=time.time() + tokens["expires_in"],
    )
    return RedirectResponse(url="/dashboard")

async function getValidToken(locationId) {
  const stored = await db.findOne('ghl_tokens', { locationId });
  if (!stored) throw new Error('No token for this location');

  // Refresh if less than 5 minutes remaining
  const BUFFER = 5 * 60 * 1000;
  if (stored.expiresAt - Date.now() < BUFFER) {
    const res = await fetch('https://services.leadconnectorhq.com/oauth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        client_id: process.env.GHL_CLIENT_ID,
        client_secret: process.env.GHL_CLIENT_SECRET,
        grant_type: 'refresh_token',
        refresh_token: stored.refreshToken,
      }),
    });
    const tokens = await res.json();
    await db.update('ghl_tokens', { locationId }, {
      accessToken: tokens.access_token,
      refreshToken: tokens.refresh_token,
      expiresAt: Date.now() + tokens.expires_in * 1000,
    });
    return tokens.access_token;
  }

  return stored.accessToken;
}

// Usage in an API route
export async function GET(req, { params }) {
  const { locationId } = params;
  const token = await getValidToken(locationId);
  const res = await fetch(`https://services.leadconnectorhq.com/contacts/search?locationId=${locationId}`, {
    headers: { Authorization: `Bearer ${token}`, Version: '2021-07-28' },
  });
  return Response.json(await res.json());
}

{
  "name": "ghl_get_access_token",
  "description": "Return a valid GoHighLevel access token for a given locationId, refreshing if needed.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "locationId": { "type": "string", "description": "GHL sub-account ID" }
    },
    "required": ["locationId"]
  }
}