The GoHighLevel API

Ten requests a second sounds comfortable until you write the first migration script. Pulling 5,000 contacts one page at a time, then fetching each contact's notes, is tens of thousands of calls, and a naive loop will hit the burst ceiling within seconds of starting. The fix is unglamorous: batch what the endpoints let you batch, sleep between pages, and read the rate limit headers rather than guessing.

The daily figure deserves a closer look because of three words in the documentation: it is 200,000 requests per day per resource. Contacts and opportunities are counted separately, so a job that touches several resources has more headroom than the single number suggests. That is unusually generous for a platform at this price, and it is worth knowing before you architect around a limit that is not there.

This is the part that costs people money, because the decision looks like $97 against $497 and is really a question about what you are building. A private integration that syncs one client's contacts into a spreadsheet works fine on Starter. A public app that other agencies install needs OAuth, which needs Agency Pro, and there is no way to buy OAuth on its own.

Now the uncomfortable part. HighLevel's pricing page lists API Access among the features shared by every plan, then lists Basic API Access again as something the $297 tier adds over the $97 one. The developer documentation says something different again: Starter and Unlimited both get basic access with location API keys. Those statements cannot all be correct.

v1 reached end of support on 31 December 2025. HighLevel's position is that existing connections keep working but receive no support and no updates, which is a softer statement than a shutdown date and a harder problem to plan around. Something that works today, has no maintainer, and could stop without notice is worse than something that is definitively switched off, because it never forces the migration.

If anything you own still talks to v1, the honest reading is that you are running on borrowed time with no warning system. v3 is in development, so the sensible target is v2 now rather than waiting to skip a version.

Most people reading this need the first one and think they need the second. A private token is a header on a request. OAuth means a consent screen, a token exchange, refresh handling and a Marketplace listing, which is a real project rather than an afternoon. Start private, and move to OAuth when someone other than you needs to install it.

The last one is worth repeating because it is the one that generates surprise invoices. A script that accidentally re-enrols 4,000 contacts into a workflow with an SMS step will send 4,000 texts, and the API will not stop you. HighLevel documents no dry-run or simulation mode, so test against a contact list of one.

If a native connection already exists you may not need the API at all, which the integrations page covers. For what the platform costs before any of this, see GoHighLevel pricing, and for whether the $497 tier earns its money beyond OAuth, the plan comparison.